[OFBIZ-11425] Test "POC for CSRF Token" (CVE-2019-12425)

• Type: Test
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Release Branch 18.12, Release Branch 17.12, Trunk
• Component/s: ALL APPLICATIONS
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 27/Feb/20 13:48
• Updated: 05/Apr/20 09:29
• Resolved: 05/Apr/20 09:29

Description

Hi All,

This "test" Jira to ask your help to review and test the work done in OFBIZ-11306. We have done all our possible, and now help is welcome. If you are experienced with penetrations tools, please use them.

You can find the branch to use in
https://github.com/JacquesLeRoux/ofbiz-framework/tree/POC-for-CSRF-Token-OFBIZ-11306
https://github.com/JacquesLeRoux/ofbiz-plugins/tree/POC-for-CSRF-Token-OFBIZ-11306.

It's ready to merge in OFBiz trunk but we will not create a PR before being rassured that we (James and I) did not miss any issues. Like links without "csrf" token, or regressions introduced by the effort.

TIA

Issue Links

• is depended upon by: OFBIZ-11306 POC for CSRF Token (CVE-2019-0235)
• links to: Draft PR for framework
• links to: PR for plugins