Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(fm): switch create FM session to POST to defeat CSRF

Browse Source 
GET /api/v1/file?id=<server> created an FM stream on the agent stream
and committed real state change (TaskTypeFM dispatched). With JWT
cookie SameSite=Lax a victim's browser would still send the cookie on
a top-level cross-site GET, so an attacker could trick a logged-in
user into opening an FM session on any of their own servers, consuming
resources and triggering the agent's FM machinery without consent.

Mirror the GHSA-8qhj-4f8c-j8qg fix: move the route to POST. SameSite=
Lax cookies are not sent on cross-site POST. Frontend (admin-frontend)
adjusted in a follow-up commit.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-26 04:07:49 +00:00
co-authored by cloudcode
parent a8f014838c
commit a4f4cb1f34
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/fm.go
+1 -1
View File
@@ -24,7 +24,7 @@ import (
// @Param id query uint true "Server ID"
// @Produce json
// @Success 200 {object} model.CreateFMResponse
// @Router /file [get]
// @Router /file [post]
func createFM(c *gin.Context) (*model.CreateFMResponse, error) {
idStr := c.Query("id")
id, err := strconv.ParseUint(idStr, 10, 64)