oss-security - CouchDB: Don't use a RESTful API from the browser, please

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <87ocjqnrtc.fsf@mid.deneb.enyo.de>
Date: Mon, 15 Feb 2010 21:54:07 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: CouchDB: Don't use a RESTful API from the browser, please

I've recently posted a somewhat fundamental security issue to the
couchdb developer mailing list, not realizing that some of us
(including Debian) have couchdb in a shipping product.  Oh well.

Here's what I wrote ("Futon" is the web front end which runs in the
browser and served from the same domain as the database itself; the
database uses a RESTful interface, meaning predictable URLs):

  Due to CSRF issues, Futon cannot use that API.  You really need to
  include some sort of token in the URL (or in an HTTP header) which
  does not get passed on automatically by the browser.  Right now,
  you're relying on HttpOnly support in the browser, which is not
  available universally.

  You also have a cross-site scripting issue with uploaded document
  attachments.  Right now, it is possible to use an inline document
  attachment in a POST request for a new document to upload Javascript
  to the server, and have it served back to you for execution.  At this
  point, the same-origin restrictions do not apply anymore.
  Unfortunately, it is a bit difficult to stop browsers from
  interpreting crafted blobs as HTML, so I have no good advice to offer
  here.  Even if the first issue is addressed, you still have to deal
  with Futon users viewing attachments accidentally.

No reaction from the developers so far.

Note that older versions (such as 0.8.0) are not affected by this
because they apparently lack any authentication whatsoever.

Sorry for this, I would have reported it privately if I had realized
that this particular ship had already sailed...

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.