Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(fm): switch create FM session to POST to defeat CSRF

Browse Source 
GET /api/v1/file?id=<server> created an FM stream on the agent stream
and committed real state change (TaskTypeFM dispatched). With JWT
cookie SameSite=Lax a victim's browser would still send the cookie on
a top-level cross-site GET, so an attacker could trick a logged-in
user into opening an FM session on any of their own servers, consuming
resources and triggering the agent's FM machinery without consent.

Mirror the GHSA-8qhj-4f8c-j8qg fix: move the route to POST. SameSite=
Lax cookies are not sent on cross-site POST. Frontend (admin-frontend)
adjusted in a follow-up commit.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-26 04:07:49 +00:00
co-authored by cloudcode
parent 94b7deef24
commit 00fde59d4d
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/controller.go
+1 -1
View File
@@ -84,7 +84,7 @@ func routers(r *gin.Engine, frontendDist fs.FS) {
auth.POST("/terminal", commonHandler(createTerminal)) auth.POST("/terminal", commonHandler(createTerminal))
auth.GET("/ws/terminal/:id", commonHandler(terminalStream)) auth.GET("/ws/terminal/:id", commonHandler(terminalStream))
auth.GET("/file", commonHandler(createFM)) auth.POST("/file", commonHandler(createFM))
auth.GET("/ws/file/:id", commonHandler(fmStream)) auth.GET("/ws/file/:id", commonHandler(fmStream))
auth.GET("/profile", commonHandler(getProfile)) auth.GET("/profile", commonHandler(getProfile))
cmd/dashboard/controller/fm.go
+1 -1
View File
@@ -24,7 +24,7 @@ import (
// @Param id query uint true "Server ID" // @Param id query uint true "Server ID"
// @Produce json // @Produce json
// @Success 200 {object} model.CreateFMResponse // @Success 200 {object} model.CreateFMResponse
// @Router /file [get] // @Router /file [post]
func createFM(c *gin.Context) (*model.CreateFMResponse, error) { func createFM(c *gin.Context) (*model.CreateFMResponse, error) {
idStr := c.Query("id") idStr := c.Query("id")
id, err := strconv.ParseUint(idStr, 10, 64) id, err := strconv.ParseUint(idStr, 10, 64)