add csrf protection

Author: fxai

blueprints/testcase_utils.py

@@ -8,7 +8,7 @@
 
 blueprint_testcase_utils = Blueprint('blueprint_testcase_utils', __name__)
 
-@blueprint_testcase_utils.route('/testcase/<id>/toggle-visibility', methods = ['GET'])
+@blueprint_testcase_utils.route('/testcase/<id>/toggle-visibility', methods = ['POST'])
 @auth_required()
 @roles_accepted('Admin', 'Red')
 @user_assigned_assessment
@@ -19,7 +19,7 @@ def testcasevisibility(id):
 
     return jsonify(newcase.to_json()), 200
 
-@blueprint_testcase_utils.route('/testcase/<id>/clone', methods = ['GET'])
+@blueprint_testcase_utils.route('/testcase/<id>/clone', methods = ['POST'])
 @auth_required()
 @roles_accepted('Admin', 'Red')
 @user_assigned_assessment
@@ -34,7 +34,7 @@ def testcaseclone(id):
 
     return jsonify(newcase.to_json()), 200
 
-@blueprint_testcase_utils.route('/testcase/<id>/delete', methods = ['GET'])
+@blueprint_testcase_utils.route('/testcase/<id>/delete', methods = ['POST'])
 @auth_required()
 @roles_accepted('Admin', 'Red')
 @user_assigned_assessment

flask.cfg

@@ -45,6 +45,4 @@ SESSION_COOKIE_SAMESITE = "Strict"
 REMEMBER_COOKIE_SECURE = True
 REMEMBER_COOKIE_SAMESITE = "Strict"
 
-# WTF CSRF protection is enabled by default
-# WTF_CSRF_ENABLED = True
-# SECURITY_CSRF_COOKIE = {"samesite": "Strict", "httponly": False, "secure": True}
+WTF_CSRF_TIME_LIMIT = None

purpleops.py

@@ -4,6 +4,8 @@
 from flask import Flask, render_template, redirect
 from flask_security import Security, auth_required, current_user
 
+from flask_wtf.csrf import CSRFProtect
+
 from blueprints import access, assessment, assessment_utils, assessment_import, assessment_export, testcase, testcase_utils
 
 
@@ -24,6 +26,7 @@
 db.init_app(app)
 
 security = Security(app, user_datastore)
+csrf = CSRFProtect(app)
 
 @app.route('/')
 @app.route('/index')

static/scripts/access.js

@@ -92,9 +92,13 @@ $("#userDetailForm").submit(function(e){
 
 // AJAX DELETE user call
 $('#deleteUserButton').click(function() {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	$.ajax({
 		url: '/manage/access/user/' + rowData.id,
 		type: 'DELETE',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		success: function(result) {
 			$('#userTable').bootstrapTable('removeByUniqueId', rowData.id)
 			$('#deleteUserModal').modal('hide')

static/scripts/assessment.js

@@ -53,9 +53,13 @@ $("#newTestcaseForm").submit(function(e){
 
 // AJAX new testcase from template POST and table append
 $('#testcaseTemplatesButton').click(function() {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	$.ajax({
 		url: `/assessment/${window.location.href.split("/").slice(-1)[0]}/import/template`,
 		type: 'POST',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		data: JSON.stringify({
 			ids: $('#testcaseTemplateTable').bootstrapTable('getSelections').map(row => row.id)
 		}),
@@ -107,12 +111,16 @@ $("#campaignTemplateForm").submit(function(e){
 
 // Toggle visibility of testcase AJAX
 function visibleTest(event) {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	event.stopPropagation();
 	row = $(event.target).closest("tr")
 	rowData = $('#assessmentTable').bootstrapTable('getData')[row.data("index")]
 	$.ajax({
 		url: `/testcase/${rowData.id}/toggle-visibility`,
-		type: 'GET',
+		type: 'POST',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		success: function(body) {
 			$('#assessmentTable').bootstrapTable('updateByUniqueId', {
 				id: body.id,
@@ -125,12 +133,16 @@ function visibleTest(event) {
 
 // Testcase clone AJAX POST and row update
 function cloneTest(event) {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	event.stopPropagation();
 	row = $(event.target).closest("tr")
 	rowData = $('#assessmentTable').bootstrapTable('getData')[row.data("index")]
 	$.ajax({
 		url: `/testcase/${rowData.id}/clone`,
-		type: 'GET',
+		type: 'POST',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		success: function(body) {
 			$('#assessmentTable').bootstrapTable('insertRow', {
 				index: row.data("index") + 1,
@@ -152,9 +164,13 @@ function deleteTestcaseModal(event) {
 
 // AJAX DELETE testcase call and remove from table
 $('#deleteTestcaseButton').click(function() {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	$.ajax({
 		url: `/testcase/${rowData.id}/delete`,
-		type: 'GET',
+		type: 'POST',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		success: function(result) {
 			$('#assessmentTable').bootstrapTable('removeByUniqueId', rowData.id)
 			$('#deleteTestcaseModal').modal('hide')

static/scripts/assessments.js

@@ -96,9 +96,13 @@ $("#importAssessmentForm").submit(function(e){
 
 // AJAX DELETE assessment call
 $('#deleteAssessmentButton').click(function() {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	$.ajax({
 		url: `/assessment/${rowData.id}`,
 		type: 'DELETE',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		success: function(result) {
 			$('#assessmentsTable').bootstrapTable('removeByUniqueId', rowData.id)
 			$('#deleteAssessmentModal').modal('hide')

static/scripts/testcase.js

@@ -12,11 +12,14 @@ $('.multiNew').click(function(event) {
 
 // When the source/target etc. table/modal is saved, post updates and refresh table
 $('.multiButton').click(function(event) {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	type = event.target.id.replace("multi", "").replace("Button", "").toLowerCase() + "s" // Hacky
 	$.ajax({
 		url: `${$("#assessment-crumb-button").attr("href")}/multi/${type}`,
 		type: 'POST',
-		
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		data: JSON.stringify({
 			data: $(`#${type}Table`).bootstrapTable("getData")
 		}),
@@ -281,6 +284,7 @@ $("#run-button").click(function(){
 
 // Delete evidence AJAX handler
 $(document).on("click", ".evidence-delete", function(event) {
+	var csrf_token = $('meta[name="csrf-token"]').attr('content');
 	target = event.target.tagName == "I" ? event.target.parentNode : event.target
 	colour = $(target).attr("class").includes("evidence-red") ? "red" : "blue"
 	url = $(target).next("a").attr("href").split("?")[0]
@@ -289,6 +293,9 @@ $(document).on("click", ".evidence-delete", function(event) {
 	$.ajax({
 		url: url,
 		type: 'DELETE',
+		headers: {
+			'X-CSRFToken': csrf_token
+		},
 		success: function(result) {
 			$(target).parent().remove()
 		}

templates/access_modals.html

@@ -30,6 +30,7 @@
         {% endfor %}
       </select>
     </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
   </form>
   {{ macros.modalTail(name="userDetail", cancelLabel="Close", actionLabel="Create") }}
 </form>

templates/assessment_modals.html

@@ -23,6 +23,7 @@
             {% endfor %}
         </select>
     </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     {{ macros.modalTail(name="newTestcase", cancelLabel="Close", actionLabel="Create") }}
 </form>
 
@@ -63,6 +64,7 @@
         <label for="formFile" class="form-label">Select your threat actor / ad-hoc TTP at <a href="https://mitre-attack.github.io/attack-navigator/" target="_blank">the Mitre ATT&CK Navigator</a> &gt; <code>Download Controls</code> &gt; <code>Download Layer as JSON</code>.</label>
         <input class="form-control" type="file" id="formFile" name="file" accept=".json,application/json">
     </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     {{ macros.modalTail(name="testcaseNavigator", cancelLabel="Close", actionLabel="Import") }}
 </form>
 
@@ -73,6 +75,7 @@
         <label for="campaignFile" class="form-label">Import Campaign from <code>Export</code> &gt; <code>Campaign Template</code>.</label>
         <input class="form-control" type="file" id="campaignFile" name="file" accept=".json,application/json">
     </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     {{ macros.modalTail(name="testcaseCampaign", cancelLabel="Close", actionLabel="Import") }}
 </form>
 
@@ -88,6 +91,7 @@
             {% endfor %}
         </select>
     </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     {{ macros.modalTail(name="exportReport", cancelLabel="Close", actionLabel="Generate") }}
 </form>
 
@@ -103,5 +107,6 @@
         <label for="variablesFile" class="form-label">Import Variables from <code>Json File</code>.</label>
         <input type="file" id="variablesFile" name="file" accept=".json,application/json">
     </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     {{ macros.modalTail(name="variables", cancelLabel="Close", actionLabel="Import") }}
 </form>

templates/assessments_modals.html

@@ -10,6 +10,7 @@
 			<label class="col-form-label">Description</label>
 			<textarea class="form-control" name="description" placeholder="The purpose of this engagement is to..." required id="description" autocomplete="off"></textarea>
 		</div>
+		<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
 	</form>
 	{{ macros.modalTail(name="newAssessment", cancelLabel="Cancel", actionLabel="Create") }}
 </form>
@@ -26,5 +27,6 @@
 		<p>Select the <code>Assessment.zip</code> file output from <code>Export > Entire Assessment</code>.</p>
 		<input class="form-control" type="file" id="formFile" name="file" accept=".zip,application/zip" autocomplete="off">
 	</div>
+	<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
 	{{ macros.modalTail(name="deleteAssessment", cancelLabel="Cancel", actionLabel="Import") }}
 </form>