5 ms·

This tag: <img src="http://192.168.1.1/router?reboot=1"> triggers a local network GET request without any CORS involvement.

by varenc 1y ago

lyu07282 1y ago
Exactly you can also trigger forms for POST or DELETE etc. this is called CSRF if the endpoint doesn't validate some token in the request. CORS only protects against unauthorized xhr requests. All decades old OWASP basics really.
- formerly_proven 1y ago
  That highly ranked comments on HN (an audience with way above average-engineer interest in software and security) get this wrong kinda explains why these things keep being an issue.
  - lyu07282 1y ago
    I don't know why you are getting downvoted, you do have a point. Some of the comments appear knowing what CORS headers are, but neither their purpose nor how it relates to CSRF it seems, which is worrying. It's not meant as disparaging. My university thought a course on OWASP thankfully, otherwise I'll probably also be oblivious.
    - _cenw 1y ago
      If you're going cross-domain with XHR, I'd hope you're mostly sending json request bodies and not forms. Though to be fair, a lot of web frameworks have methods to bind named inputs that allow either.
      - bawolff 1y ago
        This misses the point a bit. CSRF usually applies to people who want only same domain requests and dont realize that cross domain is an option for the attacker. In the modern web its much less of an issue due to samesite cookies being default .
  - mrguyorama 1y ago
    I'm betting HN is vastly more normal people and manager types than people want to admit. None of us had to pass a security test to post here. There's no filter. That makes it pretty likely that HN's community is exactly as shitty as the rest of the internet's. People need to stop treating this community like some club of enlightened elites. It's hilariously sad and self-congratulatory.
- bawolff 1y ago
  > Exactly you can also trigger forms for POST or DELETE etc You cant do a DELETE from a form. You have to use ajax. If cross DELETE needs preflight. To nitpick, CSRF is not the ability to use forms per se, but relying solely on the existence of a cookie to authorize actions with side effects.
grrowl 1y ago
I remember back in the day you could embed <img src="http://someothersite.com/forum/ucp.php?mode=logout http://someothersite.com/forum/ucp.php?mode=logout"> in your forum signature and screw with everyone's sessions across the web
- anthk 1y ago
  <img src="C:\con\con"></img>
  - jbverschoor 1y ago
    It's essentially the same, as many apps use HTTP server + html client instead of something native or with another IPC.
- lobsterthief 1y ago
  Haha I remember that. The solution at the time for many forum admins was to simply state that anyone found to be doing that would be permabanned. Which was enough to make it stop completely, at least for the forums that I moderated. Different times indeed.
  - sedatk 1y ago
    Or you could just make the logout route POST-only. Problem solved.
buildfocus 1y ago
This expectation is that this should not work - well behaved network devices shouldn't accept a blind GET like this for destructive operations. Plenty of other good reasons for that. No real alternative unless you're also going to block page redirects & links to these URLs as well, which also trigger a similar GET. That would make it impossible to access any local network page without typing it manually. While it clearly isn't a hard guarantee, in practice it does seem to generally work as these have been known issues without apparent massive exploits for decades. That CORS restrictions block probing (no response provided) does help makes this all significantly more difficult.
- oasisbob 1y ago
  "No true Scotsman allows GETs with side effects" is not a strong argument It's not just HTTP where this is a problem. There are enough http-ish protocols where protocol smuggling confusion is a risk. It's possible to send chimeric HTTP requests at devices which then interpret them as a protocol other than http.
  - bawolff 1y ago
    Yes, which is why web browsers way back even in the netscape navigator era had a blacklist of ports that are disallowed.

This tag: <img src="http://192.168.1.1/router?reboot=1"> triggers a local network GET request without any CORS involvement.

by varenc 1y ago

This tag: <img src="http://192.168.1.1/router?reboot=1"> triggers a local network GET request without any CORS involvement.

lyu07282 1y ago

Exactly you can also trigger forms for POST or DELETE etc. this is called CSRF if the endpoint doesn't validate some token in the request. CORS only protects against unauthorized xhr requests. All decades old OWASP basics really.

formerly_proven 1y ago
That highly ranked comments on HN (an audience with way above average-engineer interest in software and security) get this wrong kinda explains why these things keep being an issue.
- lyu07282 1y ago
  I don't know why you are getting downvoted, you do have a point. Some of the comments appear knowing what CORS headers are, but neither their purpose nor how it relates to CSRF it seems, which is worrying. It's not meant as disparaging. My university thought a course on OWASP thankfully, otherwise I'll probably also be oblivious.
  - _cenw 1y ago
    If you're going cross-domain with XHR, I'd hope you're mostly sending json request bodies and not forms. Though to be fair, a lot of web frameworks have methods to bind named inputs that allow either.
    - bawolff 1y ago
      This misses the point a bit. CSRF usually applies to people who want only same domain requests and dont realize that cross domain is an option for the attacker. In the modern web its much less of an issue due to samesite cookies being default .
- mrguyorama 1y ago
  I'm betting HN is vastly more normal people and manager types than people want to admit. None of us had to pass a security test to post here. There's no filter. That makes it pretty likely that HN's community is exactly as shitty as the rest of the internet's. People need to stop treating this community like some club of enlightened elites. It's hilariously sad and self-congratulatory.
bawolff 1y ago
> Exactly you can also trigger forms for POST or DELETE etc You cant do a DELETE from a form. You have to use ajax. If cross DELETE needs preflight. To nitpick, CSRF is not the ability to use forms per se, but relying solely on the existence of a cookie to authorize actions with side effects.

grrowl 1y ago

I remember back in the day you could embed <img src="http://someothersite.com/forum/ucp.php?mode=logout http://someothersite.com/forum/ucp.php?mode=logout"> in your forum signature and screw with everyone's sessions across the web

anthk 1y ago
<img src="C:\con\con"></img>
- jbverschoor 1y ago
  It's essentially the same, as many apps use HTTP server + html client instead of something native or with another IPC.
lobsterthief 1y ago
Haha I remember that. The solution at the time for many forum admins was to simply state that anyone found to be doing that would be permabanned. Which was enough to make it stop completely, at least for the forums that I moderated. Different times indeed.
- sedatk 1y ago
  Or you could just make the logout route POST-only. Problem solved.

buildfocus 1y ago

This expectation is that this should not work - well behaved network devices shouldn't accept a blind GET like this for destructive operations. Plenty of other good reasons for that. No real alternative unless you're also going to block page redirects & links to these URLs as well, which also trigger a similar GET. That would make it impossible to access any local network page without typing it manually. While it clearly isn't a hard guarantee, in practice it does seem to generally work as these have been known issues without apparent massive exploits for decades. That CORS restrictions block probing (no response provided) does help makes this all significantly more difficult.

oasisbob 1y ago
"No true Scotsman allows GETs with side effects" is not a strong argument It's not just HTTP where this is a problem. There are enough http-ish protocols where protocol smuggling confusion is a risk. It's possible to send chimeric HTTP requests at devices which then interpret them as a protocol other than http.
- bawolff 1y ago
  Yes, which is why web browsers way back even in the netscape navigator era had a blacklist of ports that are disallowed.