Cross-Site Request Forgery (CSRF) in ampache/ampache
Jul 24th 2021
When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.(I mean set default value on it) chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site more vulnerable with CSRF attacks.
But Firefox ( one of big ones ) don't set this attribute to "Lax" and set it to "none" that makes all POST and GET requests more Vulnerable to CSRF attack.
demo.apache.dev you don't set any SameSite attribute for your cookies.
develop.ampache.dev also you set SameSite attribute for all cookies to "Strict" that is good but for main session cookie that name "ampache" you didn't set any SameSite attribute.
Also you set a parameter that named
from_validation then I put the of this parameter to nothings like this
from_validation= and then I could bypass this protection too.
So in Firefox attacker can delete any message of any user With CSRF attack that users already allowed manually do it.
🕵️♂️ Proof of Concept
<html> <body> <script>history.pushState('', '', '/')</script> <form action="https://develop.ampache.dev/pvmsg.php?action=confirm_delete&msgs=2" method="POST"> <input type="hidden" name="form_validation" value="" /> <input type="submit" value="Submit request" /> </form> </body> </html>
Here the attacker should knows the
msgs parameter's value to preform attack. the parameter as I understand starting from 2 then it can be guessed easily.
This vulnerability is capable delete any message of any user that have high impact on availability of user interactions.
You should set SameSite attribute to Lax and don't use Get method for writing, Or use strict if you don't want to share cookies to any third party application.