The other day I noticed that SHIM was vulnerable to CSRF attacks, so I decided to fix that. To do this I used nosurf. It ended up being pretty simple: just plug in nosurf as middleware for your requests, and then plug the token values in a hidden
<input> element somewhere inside your
While implementing this, I also saw that SHIM’s Delete Post page had a security vulnerability: it didn’t follow the HTTP specification. How? SHIM was using a GET request to delete a page, which violates GET’s idempotent properties. But wait, how is a semantic bug a security vulnerability? How did this happen?
Why are such little things important? Do you really need to worry about the minute technical details of the HTTP protocol when building a web application? Yes. Yes you do.
It matters because these little things can have security implications that you may not have foreseen. Like opening your garage door:
You know how HTTP GET requests are meant to be idempotent? Well, do I have the story for you ... a while back I added WiFi control to our garage doors with little Wemos D1s.— Will Pearse (@rombulow) April 29, 2018
The Wemos expose a simple web page with a link that says "Toggle". The endpoint for the link activates a relay, which is hooked up to the push-button on the garage door, which makes the door raise/lower/halt.— Will Pearse (@rombulow) April 29, 2018
(This /toggle endpoint responds to GET requests. I threw the code together in minutes and was too lazy to spend another couple minutes figuring out POST. #regret)— Will Pearse (@rombulow) April 29, 2018
Safari eventually figured out I used this /toggle page regularly, so added it to my favourites. Which are iCloud-synced between all my devices.— Will Pearse (@rombulow) April 29, 2018
So every time I opened a new tab on my laptop, desktop, iPhone or iPad the garage door opened or closed. Late at night, early in the morning, or randomly throughout the day...— Will Pearse (@rombulow) April 29, 2018
This, kids, is why GET requests should be idempotent.— Will Pearse (@rombulow) April 29, 2018
While this security flaw probably didn’t affect anyone, it possibly could have.
For example a simple request to
https://www.camconn[.]cc/secret/path/to/shim/delete/<post base64>?confirm=yes could have given an attacker the ability to delete arbitrary pages on my website. That isn’t totally pwning me, but that is still pretty bad.
Anywho, SHIM has been updated. Patch your installations.