[OFBIZ-11306] POC for CSRF Token (CVE-2019-0235)

• Type: Sub-task
• Status: Closed
• Priority: Minor
• Resolution: Implemented
• Affects Version/s: 22.01.01
• Component/s: ALL APPLICATIONS
• Labels: CSRF
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: James Yong
• Created: 08/Dec/19 07:49
• Updated: 11/Jan/22 09:36
• Resolved: 05/Apr/20 09:48

Description

CRSF tokens are generated using SecureRandom class (maybe later a JWT with a "time out").
They are stored in the user sessions (for AJAX calls and unauthenticated HTTP calls) or OFBiz UtilCache (for authenticated HTTP calls), and verified during POST request.

1. In controllers a new csrf-token attribute is added to the security tag to exempt or force CSRF token check.
2. In Widget Forms a hidden token field is auto-generated.
3. In FTL form a CSRF token is passed through <@ofbizUrl> to automatise the change. Using <@ofbizUrl> macro to generate the CSRF token means there is no need to manually add the CSRF token field to each form in the ftl files. It will save time for users doing custom implementation and maintenance. While there is CSRF token in the form URL, the token is invalidated during form submission. So it's unique and harmless even though the CSRF token of the form submission is shown in the browser address bar.
4. For Ajax calls an ajaxPrefilter function (observer on DOM ready) is added through OfbizUtil.js (itself called at start in decorators and such)
5. The html metadata is storing the csrf token used by JQuery AJAX. This token will not change to another value after it is consumed
6. Csrf tokens for the user are removed from the UtilCache when the user logs out or session invalidated.

The general rule are as follows:

• RequestMap configured with 'get' method will be exempted from CSRF token check.
• RequestMap configured with 'post' or 'all' method will be subjected to CSRF token check. (Note there are discussions that RequestMap with ‘all’ method should also not be subjected to CSRF token check. This will be done after ensuring a separate uri is used when posting changes.)
• "main" request URIs are exempted from CSRF token check.
• Setting csrf-token to false or true on the Request Map will override the general rules above.

To Discuss:

• Invalidate authenticated user session when CSRF token check fails.
• Configure the general rules in a Service method (which will be run inside the constructor of RequestMap class) when determining the final securityCsrfToken value.

Issue Links

• breaks: OFBIZ-11593 "entity/list" request is not handled well
• breaks: OFBIZ-11586 Few tests don't pass when using CsrfDefenseStrategy
• Dependent: OFBIZ-11317 Add 'controlPath' attribute to 'ofbizUrl' freemarker macro
• depends upon: OFBIZ-11329 setUserTimeZone should ran only once based on error
• depends upon: OFBIZ-11425 Test "POC for CSRF Token" (CVE-2019-12425)
• duplicates: OFBIZ-10427 Add a mean to handle CSRF (CVE-2019-0235)
• is depended upon by: OFBIZ-11195 XML Entity Injection in webtools/control/entityImport
• is depended upon by: OFBIZ-11197 Arbitrary Code Execution
• is related to: OFBIZ-11319 processorder is submitted as GET instead of POST
• is related to: OFBIZ-11585 Update security.adoc with few words about our CSRF defense strategy