Vulnerability to cross-site request forgery (CSRF) on SSRS 2016

Tüm Yanıtlar

• 

  

  0

  Oylamak İçin Oturum Aç

  Hello Ricardo,

  As we know, a CSRF attack simply takes advantage of the fact that the browser sends the Cookie to the web application automatically with each and every request.

  In order to avoid CSRF attack, you can configure the SSRS web portal to pass custom authentication cookies. If you are using a custom authentication extension, you should configure the web portal to transmit custom authentication cookies. To enable additional cookies to be transmitted through HTTP requests when using the web portal, set the following elements in the RSReportServer.config file:

  <UI>  
     <CustomAuthenticationUI>  
        ...  
        <PassThroughCookies>  
           <PassThroughCookie>cookiename1</PassThroughCookie>  
           <PassThroughCookie>cookiename2</PassThroughCookie>  
        </PassThroughCookies>  
     </CustomAuthenticationUI>  
        ...  
  </UI>  

  More details, you can refer to Configure the Web Portal to Pass Custom Authentication Cookies

  And here is a serial of Microsoft documents about SSRS security and protection, I think these will help too.

  Hope it will help

  Best Regards

  Dawn
  

  ---

  MSDN Community Support
  Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

  
  

  • Düzenleyen Dawn YoungMicrosoft contingent staff 20 Mayıs 2020 Çarşamba 03:16
  • Yanıt Olarak Öneren Dawn YoungMicrosoft contingent staff 21 Mayıs 2020 Perşembe 09:50

  20 Mayıs 2020 Çarşamba 03:15
• 

  

  0

  Oylamak İçin Oturum Aç

  Hello friend,
  Have you solved the question?
  If you have resolved your issue, please mark the useful reply as answer. This can be beneficial to other community members finding and reading the thread easily. 
  In addition, if you have another questions, please feel free to ask.
  Thanks for your contribution.
  

  ---

  MSDN Community Support
  Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

  21 Mayıs 2020 Perşembe 09:50
• 

  

  0

  Oylamak İçin Oturum Aç

  Hi MSDN,

  I work with Ricardo. Let me add some background information about this security issue. As I think we are here missing the point.

  First of all we note SSRS issues anti CSRT tokens and it does it very frequently.

  We removed the XSRF tokens yet the application responded and assigned new ones.

  We have generated a CSRF POC request with all tokens and XSRF tokens removed.

  So, we generate a request, then capture it with intercept and generate a CSRF POC. Then, we can make the user to download a report unwillingly.

  Since the unpredictable token is not validated at this stage, SSRS responds by executing a download.

  This is reported due to even the file is downloaded into the user machine, we noted CSRF protection is there but is not validated as in the rest of the SSRS.

  This particularly proves the concept of SSRS being vulnerable to CSRF.

  Even though we execute the request without cookies and tokens, the web browser, sends them (append them to our request due to the inherit behavior, the browser send cookies back if requested).

  20 Ağustos 2020 Perşembe 09:07