I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems.
I'm a little worried about my own institution's system: I've implemented some external monitoring scripts to tell me if any unexpected admins appear, and we do have offline backups, which is about all I can think of to do. However, I'm also bothered that this exploit affects all such installations all over the world, and it's a commonly-run system (probably >1000 instances).
As this is SaaS, we don't have enough access to the system to be able to block it ourselves.
So I have a group of related questions:
- Is this attack acceptable, or at least common among large enterprise systems?
- If the vendor refuses to fix it, what are my next moves? Is public disclosure recommended, given that it is fairly easy to exploit once it is known about?
EDIT: To answer the comments:
I admit I'm a bit hazy on the difference between csrf and xss, despite reading articles on it. By this definition it's XSS in that it 'execute in some way a script', but it's CSRF in that it has to 'use a victim's already logged cookie/session'. Also, the token that is key to the exploit is called a csrf token by the vendor.
Here's some more detail on how the exploit/mitigation works, per (2). Although you're right; this should really be a separate question.
The attack is to include a
div. I propose replacing the
div with an
iframe that fetches the user contents separately (or uses a
srcdoc), and has a sandbox attribute without the
allow-same-origin flag. That would mean the script wouldn't have access to the authentication cookie, and wouldn't be able to make fetch requests to the API anyway because of CORS.