[AAA-197] [CSRF] Attacker can insert or modify the entry of flow table Created: 06/Mar/20 Updated: 06/Jul/22 Resolved: 06/Jul/22 |
|
| Status: | Resolved |
| Project: | aaa |
| Component/s: | General |
| Affects Version/s: | Sodium SR1 |
| Fix Version/s: | 0.16.0 |
| Type: | Bug | Priority: | High |
| Reporter: | Seongil Wi | Assignee: | Robert Varga |
| Resolution: | Duplicate | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | 4 hours | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | 4 hours | ||
| Environment: |
Browsers Verified In:
|
||
| Attachments: |
|
||||||||
| Issue Links: |
|
||||||||
| Description |
| Comments |
| Comment by Robert Varga [ 23/Apr/20 ] |
|
I think it is AAA's job to secure the HTTP endpoints. Unfortunately I do not remember the details anymore |
| Comment by Robert Varga [ 23/Apr/20 ] |
|
So if I am reading this correctly, the problem is the CORS filter configuration dating back all the way back to https://git.opendaylight.org/gerrit/c/aaa/+/12533 ... now the next step is to understand the threat model used in those things. |
| Comment by Robert Varga [ 08/Dec/21 ] |
|
So here I think we need to tighten our policy, but let it still be configurable. The CORS filter was added to allow easy embedding of RESTCONF requests into portals – which I do not think is being used anymore. |
| Comment by Robert Varga [ 06/Jul/22 ] |
|
Fixed by removing CORS filter in |