CVE-2013-7251 (Java, published 2014-01-02T14:59Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/, (2) web/core/, (3) web/dialog/, (4) web/fibu/, (5) web/mobile/, (6) web/task/, or (7) web/wicket/.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/micromata/projectforge-webapp
Files changed:
src/main/java/org/projectforge/web/admin/SetupForm.java
src/main/java/org/projectforge/web/admin/SetupImportForm.java
src/main/java/org/projectforge/web/admin/SetupPage.html
src/main/java/org/projectforge/web/admin/SystemUpdateForm.java
src/main/java/org/projectforge/web/admin/SystemUpdatePage.html
src/main/java/org/projectforge/web/core/NavTopPanel.html
src/main/java/org/projectforge/web/core/NavTopPanel.java
src/main/java/org/projectforge/web/dialog/ModalDialog.html
src/main/java/org/projectforge/web/dialog/ModalDialog.java
src/main/java/org/projectforge/web/fibu/RechnungCostEditTablePanel.html
src/main/java/org/projectforge/web/fibu/RechnungCostEditTablePanel.java
src/main/java/org/projectforge/web/mobile/AbstractMobileEditForm.java
src/main/java/org/projectforge/web/mobile/AbstractMobileEditPage.html
src/main/java/org/projectforge/web/mobile/AbstractMobileListForm.java
src/main/java/org/projectforge/web/mobile/AbstractMobileListPage.html
src/main/java/org/projectforge/web/task/TaskTreeForm.java
src/main/java/org/projectforge/web/task/TaskTreePage.html
src/main/java/org/projectforge/web/wicket/CsrfTokenHandler.java
src/main/java/org/projectforge/web/wicket/components/DropFileContainer.html
src/main/java/org/projectforge/web/wicket/components/DropFileContainer.java
Commit message: CSRF protection.


Vulnerable code:
        <h3 id="myModalLabel" wicket:id="titleContainer"><span wicket:id="titleText">[title]</span></h3>
      <wicket:message key="rest" />: <span wicket:id="restValue">[-1234,00]</span></div>
    this.form = new Form<AbstractRechnungsPositionDO>("form");
<wicket:extend>
  <form wicket:id="form" autocomplete="off">
  <div data-role="fieldcontain" id="searchfield"><input type="text" data-type="search" wicket:id="searchField" id="search" placeholder="Suche" /></div>
  </form>
  <wicket:container wicket:id="listViewPage">
  </wicket:container>
</wicket:extend>
      listViewButtonPanel = new SingleButtonPanel(actionButtons.newChildId(), listViewButton, getString("listView"), SingleButtonPanel.NORMAL);
import org.apache.wicket.model.Model;
  private HiddenField<String> csrfTokenField;
    form.add(csrfTokenField = new HiddenField<String>("csrfToken", Model.of(getCsrfSessionToken())));
    final String postedCsrfToken = this.csrfTokenField.getInput();
    if (StringUtils.equals(sessionCsrfToken, postedCsrfToken) == false) {
          + postedCsrfToken);
    <div class="pf_filedrag"><wicket:message key="drop" /></div>
      <input type="submit" class="pf_submit" wicket:id="submitButton" />
  public DropFileContainer(final String id, final String mimeType) {

Fixed code:
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

    csrfTokenHandler = new CsrfTokenHandler(this);
          csrfTokenHandler.onSubmit();
  @Override
  protected void onSubmit()
  {
    super.onSubmit();
    csrfTokenHandler.onSubmit();
  }

import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

    csrfTokenHandler = new CsrfTokenHandler(this);
  }

  @Override
  protected void onSubmit()
  {
    super.onSubmit();
    csrfTokenHandler.onSubmit();
            <input type="hidden" wicket:id="csrfToken" />
          <input type="hidden" wicket:id="csrfToken" />
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

    csrfTokenHandler = new CsrfTokenHandler(this);

  @Override
  protected void onSubmit()
  {
    super.onSubmit();
    csrfTokenHandler.onSubmit();
  }
      <input type="hidden" wicket:id="csrfToken" />
            <input type="hidden" wicket:id="csrfToken" />
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private CsrfTokenHandler csrfTokenHandler;

        csrfTokenHandler.onSubmit();
    csrfTokenHandler = new CsrfTokenHandler(searchForm);
        <h3 id="myModalLabel" wicket:id="titleContainer">
          <span wicket:id="titleText">[title]</span>
        </h3>
        <input type="hidden" wicket:id="csrfToken" />
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  protected CsrfTokenHandler csrfTokenHandler;

        csrfTokenHandler.onSubmit();
    csrfTokenHandler.onSubmit();
    csrfTokenHandler = new CsrfTokenHandler(form);
          csrfTokenHandler.onSubmit();
        csrfTokenHandler.onSubmit();
        csrfTokenHandler.onSubmit();
    csrfTokenHandler.onSubmit();
    csrfTokenHandler.onSubmit();
        csrfTokenHandler.onSubmit();
        <wicket:message key="rest" />
        : <span wicket:id="restValue">[-1234,00]</span>
      </div>
      <input type="hidden" wicket:id="csrfToken" />
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

  @SuppressWarnings("serial")
    this.form = new Form<AbstractRechnungsPositionDO>("form") {
      @Override
      protected void onSubmit()
      {
        super.onSubmit();
        csrfTokenHandler.onSubmit();
      }
    };
    csrfTokenHandler = new CsrfTokenHandler(form);
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

    csrfTokenHandler = new CsrfTokenHandler(this);
  }

  @Override
  protected void onSubmit()
  {
    super.onSubmit();
    csrfTokenHandler.onSubmit();
        <input type="hidden" wicket:id="csrfToken" />
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

    csrfTokenHandler = new CsrfTokenHandler(this);
  }

  @Override
  protected void onSubmit()
  {
    super.onSubmit();
    csrfTokenHandler.onSubmit();
  <wicket:extend>
    <form wicket:id="form" autocomplete="off">
      <div data-role="fieldcontain" id="searchfield">
        <input type="text" data-type="search" wicket:id="searchField" id="search" placeholder="Suche" />
      </div>
      <input type="hidden" wicket:id="csrfToken" />
    </form>
    <wicket:container wicket:id="listViewPage">
    </wicket:container>
  </wicket:extend>
import org.projectforge.web.wicket.CsrfTokenHandler;
  /**
   * Cross site request forgery token.
   */
  private final CsrfTokenHandler csrfTokenHandler;

      listViewButtonPanel = new SingleButtonPanel(actionButtons.newChildId(), listViewButton, getString("listView"),
          SingleButtonPanel.NORMAL);
    csrfTokenHandler = new CsrfTokenHandler(this);
    csrfTokenHandler.onSubmit();
      <input type="hidden" wicket:id="csrfToken" />
import org.apache.wicket.model.PropertyModel;
  private final String csrfToken;
    csrfToken = getCsrfSessionToken();
    form.add(new HiddenField<String>("csrfToken", new PropertyModel<String>(this, "csrfToken")));
    if (StringUtils.equals(sessionCsrfToken, csrfToken) == false) {
          + csrfToken);
    <div class="pf_filedrag">
      <wicket:message key="drop" />
    </div>
      <input type="submit" class="pf_submit" wicket:id="submitButton" /> <input type="hidden" wicket:id="csrfToken" />
import org.projectforge.web.wicket.CsrfTokenHandler;

  /**
   * Cross site request forgery token.
   */
  private  CsrfTokenHandler csrfTokenHandler;

  public DropFileContainer(final String id, final String mimeType)
  {
        csrfTokenHandler.onSubmit();
    csrfTokenHandler = new CsrfTokenHandler(hiddenForm);