[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[EP-tech] CSRF

Hi Maher,

To check whether the CSRF token is appearing you will need to look into the HTML source for something like:

<input id="csrf_token" name="csrf_token" type="hidden" value="<TIMESTAMP>:<HASH>" />

Where <TIMESTAMP> is something like 1573375123 and <HASH> is something like 0123456789abcdef0123456789abcdef.  You will need to have at least reloaded Apache (e.g. apachectl graceful) for the addition of EPRINTS_PATH/archives/ARCHIVE_NAME/cfg/cfg.d/csrf_protection.pl to be applied to you running configuration.  The HTML shown above will only appear in forms if you are logged in as a user.  So will not appear in the actual login form (/cgi/users/login) or the search forms (/cgi/search/simple or/cgi/search/advanced) unless you are logged in.  CSRF protection only applies when an authenticated user is trying to make a request, as they would likely have permissions that an unauthenicated user may not.

One thing that should be noted is that staticly generated abstract pages will not contain csrf_token's for their export forms.  This is because these exports do not require user authentication and as the page and subsequently the form are generated without the concept of a user being logged in the forms will not get a csrf_token.  I guess this would cause an uninformed vulnerability scanner to report an error.  Either you should add an exception to your scanner or if it is still a concern (although I believe it causes no security risk) remove the tools box from your abstract page configuration.  I would usually add the following line to ARCHIVENAME/cfg/cfg.d/plugins.pl:

$c->{plugins}{"Screen::EPrint::Box::Tools"}{params}{disable} = 1;

Before reloading Apache, you will need to run:

EPRINTS_PATH/bin/epadmin refresh_abstracts ARCHIVE_NAME

Hopefully this is helpful.  There may be other places where read-only forms like abstract page export exists that could record an error in your vulnerability scanner.  If you could report specific pages and the specific action URLs of the forms that is reporting the vulnerability, I can take a look.  If it is something that effects a whole class of pages like the abstract page situation I described, a single example should be sufficient for me to investigate.


David Newman

On 10/11/2019 05:24, Maher Abdellatif Ahmad Qahwash wrote:
Hi Newman,
It's a new installation and the file exist under this path (EPRINTS_PATH /archives/ ARCHIVE_NAME /cfg/cfg.d) but our security team is doing a vulnerability scan using Acunetix and it's giving CSRF Token missing error on all pages.
Is there a way we can verify that CSRF token are being applied?

From: Newman D.R. [mailto:drn at ecs.soton.ac.uk]
Sent: Thursday, November 07, 2019 3:13 PM
To: eprints-tech at ecs.soton.ac.uk<mailto:eprints-tech at ecs.soton.ac.uk>; Maher Abdellatif Ahmad Qahwash
Subject: Re: [EP-tech] CSRF

?????: ??? ??????? ????? ?? ???? ???????. ?? ???? ?? ???? ?? ???? ?? ?? ??? ??????? ?? ??? ???

Warning: This mail has been sent from outside KFUPM. Do not open links or attachments unless you are sure they are safe.


Hi Maher,

This depends if you have just created a new repository/archive or if you have upgraded to 3.4.1 for an existing archive.  For the latter you will need to manually copy EPRINTS_PATH/lib/defaultcfg_zero/cfg.d/csrf_protection.pl to you archive (i.e.  EPRINTS_PATH/archives/ARCHIVE_NAME/cfg.d/csrf_protection.pl).  Otherwise csrf_protection.pl should have automatically added to you archive on creation.  Either way it is best you change the csrf_token_salt config variable to something else.  Generating a suitable token salt can be done using OpenSSL:

openssl rand -base64 8

8 characters should be more than sufficient, as the current time is also used in generating each token.  Using the default token salt gives you improved security but is not ideal as a determined hacker could work out valid tokens they could use.


David Newman
On 07/11/2019 11:54, Maher Abdellatif Ahmad Qahwash via Eprints-tech wrote:

We are running eprints 3.4.1 and would like know if CSRF is enabled by default or we need to enable it in the configuration?


*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fimsva91-ctp.trendmicro.com%3A443%2Fwis%2Fclicktime%2Fv1%2Fquery%3Furl%3Dhttp%253a%252f%252fmailman.ecs.soton.ac.uk%252fmailman%252flistinfo%252feprints%252dtech%26umid%3D4A2CBA3C-96F7-4405-89EF-8E57960DED71%26auth%3Dec34f7633709e8bd85e48c7fc0c92c09c079e558-d8da8bcc19de80eb0ce4452485e58f68a10f097a&data=01%7C01%7C%7C534d19312c044039e12608d765bed08b%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=jWa7lr1gjcNPxu2X0HoVy6sW2ntIDxqYBFzFATlvfMQ%3D&reserved=0>

*** Archive: http://www.eprints.org/tech.php/<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fimsva91-ctp.trendmicro.com%3A443%2Fwis%2Fclicktime%2Fv1%2Fquery%3Furl%3Dhttp%253a%252f%252fwww.eprints.org%252ftech.php%252f%26umid%3D4A2CBA3C-96F7-4405-89EF-8E57960DED71%26auth%3Dec34f7633709e8bd85e48c7fc0c92c09c079e558-353468600e43e6d8e80d0df4d800b0343c7b4e7c&data=01%7C01%7C%7C534d19312c044039e12608d765bed08b%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=AYmT2AoXmPG77MWJtsjvPnrkFsLIfeTkfhpzQtDS2M4%3D&reserved=0>

*** EPrints community wiki: http://wiki.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fimsva91-ctp.trendmicro.com%3A443%2Fwis%2Fclicktime%2Fv1%2Fquery%3Furl%3Dhttp%253a%252f%252fwiki.eprints.org%26umid%3D4A2CBA3C-96F7-4405-89EF-8E57960DED71%26auth%3Dec34f7633709e8bd85e48c7fc0c92c09c079e558-02a4a9970dd9e34eabe440223c257afd1f5451b0&data=01%7C01%7C%7C534d19312c044039e12608d765bed08b%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=GhG0outoIY0e7EF8ApdZCE3ASDwLLUU1Bl1Uh5Yk1Qc%3D&reserved=0>

*** EPrints developers Forum: http://forum.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fimsva91-ctp.trendmicro.com%3A443%2Fwis%2Fclicktime%2Fv1%2Fquery%3Furl%3Dhttp%253a%252f%252fforum.eprints.org%26umid%3D4A2CBA3C-96F7-4405-89EF-8E57960DED71%26auth%3Dec34f7633709e8bd85e48c7fc0c92c09c079e558-e391eacbb88af9590818e48684d2a0502c96ecd2&data=01%7C01%7C%7C534d19312c044039e12608d765bed08b%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=jmGIasUD3qNZ6o9MttRQJ9tzR1HweflFKC0TvoEpSY0%3D&reserved=0>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ecs.soton.ac.uk/pipermail/eprints-tech/attachments/20191110/dde2845d/attachment-0001.html