Security Alert

Severity:	High
Category:	CSRF
Affected Projects:	edx-platform
Reporter:	self-reported
Permanent URL:

During a review of the edX platform code some side-effecting HTTP GET requests were discovered.  Such requests are generally undesirable and do not enforce Cross Site Request Forgery (CSRF) protection.  In one specific case users could potentially escalate their privileges via an attack against staff or super users.

More Information

This patch fixes an issue where a malicious user could lure an instructor to view a page that could in turn grant the malicious user additional privileges.

Although the platform is already using Django’s Cross-Site Request Forgery (CSRF) middleware protection, some endpoints with side effects were found to be using GET methods. The patch forces these endpoints to require POST, which also properly enables CSRF protection.

For more information, see:

– https://docs.djangoproject.com/en/1.9/ref/csrf/

We strongly advise you to patch your instances as soon as possible.

Patch for those tracking master closely:
https://github.com/edx/edx-platform/commit/d54f79f5bf3e1af17063937df1abc…

Patch for named-release dogwood:
https://github.com/edx/edx-platform/commit/d929c1cd8ca11d801a03232f200c9…