描述
Description
A cross-site request forgery (CSRF) vulnerability occurs when: A Web application uses session cookies. The application acts on an HTTP request without verifying that the request was made with the user's consent.
There are 5 cases of CSRF in ui-grid.
- The application generates HTTP request via a form post at fileChooserEditor.html line 2. PoC:
<div>
<form
name="inputForm">
<input
ng-class="'colt' + col.uid"
ui-grid-edit-file-chooser
type="file"
id="files"
name="files[]"
ng-model="MODEL_COL_FIELD"/>
</form>
</div>
The form post at fileChooserEditor.html line 2 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
- The application generates HTTP request via a form post at index.html line 124 and at index.html line 149. PoC (L124):
<form>
<div class="col-sm-12 col-md-6 col-lg-4" ng-repeat="v in variables track by $index">
<label for="{{ v.name }}" class="muted">{{ v.name }}</label> <input id="{{ v.name }}" type="text" class="form-control" ng-model="v.value" ng-change="updateCSS()">
</div>
</form>
PoC (L149):
<form>
<label for="customLess">Custom Less</label>
<textarea class="form-control" id="customLess" rows="4" ng-model="customLess" ng-change="updateCSS()" ng-init="customLess = ''"></textarea>
</form>
The form post at index.html line 124 and line 149 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
Location (124-128): https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/misc/site/customizer/index.html#L124-L128
Location (149-152): https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/misc/site/customizer/index.html#L149-L152
- The application generates HTTP request via a form post at importerMenuItem.html line 3. PoC:
<li
class="ui-grid-menu-item">
<form>
<input
class="ui-grid-importer-file-chooser"
type="file"
id="files"
name="files[]"/>
</form>
</li>
The form post at importerMenuItem.html line 3 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
- The application generates HTTP request via a form post at dropdownEditor.html line 2. PoC:
<div>
<form
name="inputForm">
<select
ng-class="'colt' + col.uid"
ui-grid-edit-dropdown
ng-model="MODEL_COL_FIELD"
ng-options="field[editDropdownIdLabel] as field[editDropdownValueLabel] CUSTOM_FILTERS for field in editDropdownOptionsArray">
</select>
</form>
</div>
The form post at dropdownEditor.html line 2 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
- The application generates HTTP request via a form post at cellEditor.html line 2. PoC:
<div>
<form
name="inputForm">
<input
type="INPUT_TYPE"
ng-class="'colt' + col.uid"
ui-grid-editor
ng-model="MODEL_COL_FIELD" />
</form>
</div>
The form post at cellEditor.html line 2 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.