4 ms·
Finally CSRF attack scenarios on outdated router firmwares can be prevented. CORS was basically ineffective in a lot of ways because it only works - by design
by cookiengineer 5y ago
Finally CSRF attack scenarios on outdated router firmwares can be prevented.
CORS was basically ineffective in a lot of ways because it only works - by design - with newer servers that send those headers and with newer browsers that actually respect the headers and not simply ignore them. It was also ineffective for older servers from pre-CORS ages. The never break the web mentality didn't work out for this scenario.
Looking forward to this! Finally the LOIC and routersploit web implementations are ineffective. Now drop support for ftp in the web browser and we are good to go.
(̶F̶i̶r̶e̶f̶o̶x̶ ̶c̶a̶n̶ ̶s̶t̶i̶l̶l̶ ̶b̶e̶ ̶a̶b̶u̶s̶e̶d̶ ̶t̶o̶ ̶D̶D̶o̶S̶ ̶v̶i̶a̶ ̶f̶t̶p̶ ̶u̶r̶l̶s̶)̶
edit: correction: I was wrong: Firefox finally phased out ftp support this year in July.
- yjftsjthsd-h 5y ago> Firefox can still be abused to DDoS via ftp urls How? They dropped FTP support a few versions ago (https://blog.mozilla.org/addons/2021/04/15/built-in-ftp-implementation-to-be-removed-in-firefox-90/ https://blog.mozilla.org/addons/2021/04/15/built-in-ftp-impl...).
- daveevad 5y agoCorrect me if I'm wrong but the browser still sends the request. The browser checks for the response's CORS headers to see if the response can be used but there's potentially an attack vector even when the response is ignored.
- funcDropShadow 5y ago> The never break the web mentality Would you pass on that memo to the Chrome developers, please?
- shakna 5y ago> Firefox can still be abused to DDoS via ftp urls Firefox deprecated FTP in 2015, and required it be manually re-enabled since April last year (FF88), and completely removed it in July (FF90), this year.
- cookiengineer 5y agoThanks on the hint! I was assuming that they will drop support by the end of this year, didn't follow it up recently so I missed the update in July about it.
- shakna 5y agoThe web moves at a brutal pace. It's easy to miss one announcement among all the many, many others.
- b112 5y agoThe sad part is, I now have clients refusing to upgrade Firefox. Great. And while I blame Mozilla for much, this isn't their fault. I almost feel as if end users should need a network license, and if they get too many tickets, no license for them! And yes, it is not realistic.
- wila 5y ago> The sad part is, I now have clients refusing to upgrade Firefox. If these clients are on Windows... tell them to use Windows Explorer.. it has FULL ftp capabilities. You don't need a browser for ftp, or even an FTP specific program.
- 5y ago