CVE-2022-3221 (published 2022-09-15T09:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/ikus060/rdiffweb
commit_details: repo_url: https://github.com/ikus060/rdiffweb
author: Patrik Dufresne
author_date: 2022-09-14 08:40:17-04:00
msg: Mitigate CSRF in profile's SSH Keys #212
repository: repo_url: https://github.com/ikus060/rdiffweb
repo_name: ikus060/rdiffweb
description: A simplified backup management software for quick access to your archives through an efficient web interface.
repo_language: Python
owner: ikus060
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -107,6 +107,12 @@ Professional support for Rdiffweb is available by contacting [IKUS Soft](https:/
 
 # Changelog
 
+## 2.4.3 (2022-09-14)
+
+This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.
+
+* Mitigate CSRF in profile's SSH Keys #212
+
 ## 2.4.2 (2022-09-12)
 
 This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

programming_language: Markdown
filename: pref_sshkeys.py
change_type: ModificationType.MODIFY
diff: @@ -111,9 +111,10 @@ class SSHKeysPlugin(Controller):
 
         # Handle action
         form = SshForm()
-        if action == "add":
+        delete_form = DeleteSshForm()
+        if action == "add" and form.is_submitted():
             self._add_key(action, form)
-        elif action == 'delete':
+        elif action == 'delete' and delete_form.is_submitted():
             self._delete_key(action, DeleteSshForm())
 
         # Get SSH keys if file exists.

programming_language: Python
filename: test_page_prefs_ssh.py
change_type: ModificationType.MODIFY
diff: @@ -99,6 +99,18 @@ class SSHKeysTest(rdiffweb.test.WebCase):
         self.assertInBody("Invalid SSH key.")
         self.assertEqual(0, len(list(user.authorizedkeys)))
 
+    def test_add_get_method(self):
+        # Given an authenticated user
+        user = self.app.store.get_user('admin')
+        # When querying a page with parameters (HTTP GET)
+        self.getPage(
+            "/prefs/sshkeys?action=add&title=ssh1&key=ssh-rsa+AAAAB3NzaC1yc2EAAAADAQABAAAAgQCzurRNVKwb0ZJCmUgGenoe4vth5gnHxgnzjHSUO8r7IZiouB6DAciiVUAryV6MQm5trwIXNo0QDwFxyX99exIwUlDu3OzhZHKKbb721hCID17AWZMAQIgxQdu6b27s5YgJXsaxXWvEO2lSRVOnVXoCSI7mK5St%2FCJ8O1OdXivNIQ%3D%3D+noname%0D%0A"
+        )
+        # Then page return without error
+        self.assertStatus(200)
+        # Then ssh key is not added
+        self.assertEqual(0, len(list(user.authorizedkeys)))
+
     def test_delete(self):
         # Delete existing keys
         user = self.app.store.get_user('admin')

programming_language: Python