Index: classes/Misc.php =================================================================== --- classes/Misc.php.orig +++ classes/Misc.php @@ -1354,6 +1354,10 @@ echo '

', htmlspecialchars($lang['sessionsecuritywarning']), '

'; } + if (!$conf['extra_session_security']) { + echo '

', htmlspecialchars($lang['sessionsecuritywarning']), '

'; + } + echo "
"; if ($server_info && isset($server_info['platform']) && isset($server_info['username'])) { Index: conf/config.inc.php-dist =================================================================== --- conf/config.inc.php-dist.orig +++ conf/config.inc.php-dist @@ -98,6 +98,15 @@ // to this feature and will be vulnerable to CSRF attacks. $conf['extra_session_security'] = true; + // If extra session security is true, then PHP's session cookies will have + // SameSite cookie flags set to prevent CSRF attacks. If you're using + // auto-start sessions, autostarted sessions will be destroyed and + // restarted with SameSite on. If this this solution is not acceptable for + // your situation, you will need to either turn off auot-start sessions, or + // turn off secure sessions. Versions of PHP below 7.3 do not have access + // to this feature and will be vulnerable to CSRF attacks. + $conf['extra_session_security'] = true; + // AutoComplete uses AJAX interaction to list foreign key values // on insert fields. It currently only works on single column // foreign keys. You can choose one of the following values: Index: tests/manual/issue-94/README.md =================================================================== --- /dev/null +++ tests/manual/issue-94/README.md @@ -0,0 +1,42 @@ +# Testing CSRF vulnerabilities (Issue #94) + +How to test: + +1. Start phppgadmin: + +``` +$ cd /path/to/phppgadmin +$ php -S localhost:8000 +``` + +2. Set up a testing domain in /etc/hosts: + +``` +127.0.0.1 localhost2 +``` + +3. Start the tests + +``` +$ cd /path/to/phppgadmin/tests/manual/issue-94 +$ php -S localhost2:8001 +``` + +4. Open both sites in the same browser (different windows or tabs): + +``` +http://localhost:8000 +``` + +``` +http://localhost2:8001 +``` + +5. Log in to phppgadmin + +6. Run a test + +Choose a test from the list. Open your console, and click "Submit Request" -- you should see a CORS error, but the request should also appear in the network tab. Open it to see the response. + +If you see a login page, phppgadmin is protected. If not, phppgadmin is vulnerable. + Index: tests/manual/issue-94/index.html =================================================================== --- /dev/null +++ tests/manual/issue-94/index.html @@ -0,0 +1,12 @@ + + +Issue #94 (CSRF vulnerabilities) proof of concepts + + +

Issue #94: CSRF vulnerabilities

+
    +
  • Proof of concept #1: out of band technique
    • +
  • Proof of concept #2: remote code execution
    • +
      + + Index: tests/manual/issue-94/poc1.html =================================================================== --- /dev/null +++ tests/manual/issue-94/poc1.html @@ -0,0 +1,48 @@ + + + +
      + +
      + + Index: tests/manual/issue-94/poc2.html =================================================================== --- /dev/null +++ tests/manual/issue-94/poc2.html @@ -0,0 +1,53 @@ + + + +
      + +
      + + Index: themes/global.css =================================================================== --- themes/global.css.orig +++ themes/global.css @@ -92,6 +92,26 @@ body.browser { color: #9F6000; } +/** alert banner **/ +.alert-banner { + background-color: #FEEFB3; + border: 1px dotted #9F6000; + color: #9F6000; + padding: 4px; + margin: 4px 0; +} +.alert-banner p { + margin: 0; + padding: 0; +} +.alert-banner p:before { + content: url(../../images/themes/default/ObjectNotFound.png); + vertical-align: -20%; +} +.alert-banner p a { + color: #9F6000; +} + /** bottom link back to top **/ .bottom_link { position: fixed;