Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 Mar 2014 15:56:12 +0000
From: Florent Daigniere <>
Subject: Re: CVE request: MediaWiki 1.22.5 login csrf

On Fri, 2014-03-28 at 08:33 -0700, Chris Steipp wrote:
> On Mar 28, 2014 7:54 AM, "Florent Daigniere" <
>> wrote:
> >
> > Sorry to be thick here but it still doesn't make any sense to me...
> >
> > The session-id should be renewed upon login AND any credential/privilege
> > change (that includes password changes). This protects against session
> > fixation attacks (where the attacker coerce a user into using a session
> > he controls).
> >
> > On these pages, there's usually no need for anti-CSRF protection as they
> > tend to require credentials (something the attacker, by definition,
> > doesn't have).
> Slightly different attack. The attacker (who knows their own password and
> chooses the reset-to password) was able to cause a logged out user (victim)
> to login with the attacker's account via the change password form.

That is the textbook example of a session-fixation attack. The "end
state" is that the victim uses a session the attacker can control.

> This attack is somewhat specific to mediawiki since we allow users to
> define JavaScript that will be loaded on pages they visit while logged
> in... So the victim in this case would run the attacker's personal
> JavaScript.

It still doesn't make sense. Anti-CSRF tokens are only useful if the
"malicious script" is not running with the same origin!


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.