Timeline for Is theme_pager() vulnerable to HTTP Parameter Pollution?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 7, 2013 at 15:28 | comment | added | greggles | One other thought: I always ask the vendors of the scan (or the company who ran it for you) to give an example of how to exploit the issue. Most of the time they can't at which point my sense is that it's not a valid issue and is in the report just to bulk it up... | |
| Jun 7, 2013 at 15:27 | comment | added | greggles | Your cat link is a cool trick! That destination=logout issue seems to me to be more about "logout is vulnerable to csrf" - see drupal.org/node/620280 for discussion and remediation if you care about that. I think that's an example where the parameter pollution has a behavior that is an annoyance rather than something malicious. if there is a url that changes something then THAT url is a CSRF issue and parameter pollution is one way (not even a particularly easy way) to exploit it among many others. | |
| Jun 7, 2013 at 15:22 | history | edited | greggles | CC BY-SA 3.0 |
added 1 characters in body
|
| Jun 7, 2013 at 13:28 | comment | added | rcourtna | thanks for chiming in on this. There might be some validity to the scan results. Although I'm not crafty enough to do any real harm, I can create a confusing url. Again, a link to a search for "cat": link. If you change the "Sort by:" field, you will be 1) logged out and 2) taken to a page of my choosing. No harm done, but you if had admin access, and I knew there was an url that changed something, or did something expensive (ie: flush cache)... This obviously isn't about theme_pager() anymore | |
| Jun 7, 2013 at 3:09 | history | answered | greggles | CC BY-SA 3.0 |