Re: [EP-tech] CSRF Vulnerability in EPrints
Christopher Gutteridge via Eprints-tech <[email protected]>
| Newsgroups | gmane.comp.web.eprints.devel |
|---|---|
| Message-ID | <EMEW3|9461fb4c5c23287c2a48a14935f0c5a7v2RAxK14eprints-tech-bounces|ecs.soton.ac.uk|[email protected]> |
It's not appropriate to discuss software vulnerabilities on a publicly archived thread. If a bug does exist, then it should be raised quietly so that people get told about it at the same time as an upgrade or patch to fix it.
On 28/03/2019 09:55, Adam Field via Eprints-tech wrote:
Hi
We’ve had a report from an independent security researcher (Jisc’s policy encourages reporting of issues) that EPrints suffers from a CSRF vulnerability. The fix for this would be to add tokens to forms so that EPrints can validate that a submitted form was one that it generated.
This is obviously a fairly complex problem to solve, with changes to multiple parts of EPrints, probably requiring a new field type, as well as the storing of tokens somewhere (perhaps a new dataset). Has anyone taken a look at this?
Thanks
--
Adam
*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech
*** Archive: http://www.eprints.org/tech.php/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.eprints.org%2Ftech.php%2F&data=01%7C01%7C%7Ce8159371f7ae4b09ef9a08d6b36c5b27%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=eUIQul%2BRi0U49MY9sMbu9mlmQ%2BhoTYlQlK3yQj6jhLs%3D&reserved=0>
*** EPrints community wiki: http://wiki.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.eprints.org%2F&data=01%7C01%7C%7Ce8159371f7ae4b09ef9a08d6b36c5b27%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=iL9lfJuzdPACx3icQufbtfYquLOxM8Iz95bATfIWGh8%3D&reserved=0>
*** EPrints developers Forum: http://forum.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fforum.eprints.org%2F&data=01%7C01%7C%7Ce8159371f7ae4b09ef9a08d6b36c5b27%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=Gk5JyoXcDC7MOEc6I7ndBakYJrGalMb2qxs6GuDrneQ%3D&reserved=0>
--
Christopher Gutteridge <[email protected]><mailto:[email protected]>
You should read our team blog at http://blog.soton.ac.uk/webteam/
*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech
*** Archive: http://www.eprints.org/tech.php/
*** EPrints community wiki: http://wiki.eprints.org/
*** EPrints developers Forum: http://forum.eprints.org/