Re: [quicwg/base-drafts] Document request forgery (#3996)

Mike Bishop <> Wed, 02 September 2020 19:34 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A50703A0D4E for <>; Wed, 2 Sep 2020 12:34:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.1
X-Spam-Status: No, score=-3.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id uWj5nhBBJ-yV for <>; Wed, 2 Sep 2020 12:34:00 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 2D6A03A0D41 for <>; Wed, 2 Sep 2020 12:34:00 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 6F42C60057B for <>; Wed, 2 Sep 2020 12:33:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1599075239; bh=G00fFQFfLJ2D6oESHu20TkFcJYfrWi7oDpZycsTDKKs=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=JsRPpfWvmYzwSJ39FEyx+1svSYQFexayjP3LzAclrkYBld2+AM04mBeH65aTXkuEp VD9Q8xAM37XDH6yc+nFbdu4ioloBbXXABNr27ZtEyHXVWWCLOM9zYK9uymz/S/d8AE wv02r8zCLC+ZhEhTxsMzpGmH1X9uJHv1uHmXdGc4=
Date: Wed, 02 Sep 2020 12:33:59 -0700
From: Mike Bishop <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/pull/3996/review/>
In-Reply-To: <quicwg/base-drafts/pull/>
References: <quicwg/base-drafts/pull/>
Subject: Re: [quicwg/base-drafts] Document request forgery (#3996)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5f4ff3a75f6ea_46e819f035109a"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: MikeBishop
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 02 Sep 2020 19:34:02 -0000

@MikeBishop commented on this pull request.

> +what packets the peer sends and where these packets are sent. If an attacker
+can target a vulnerable service with a controlled payload, that service might
+perform actions that are attributed to the attacker's peer, but decided by the
+For example, cross-site request forgery {{?CSRF=DOI.10.1145/1455770.1455782}}
+exploits on the Web cause a client to issue requests that include authorization
+cookies {{?COOKIE=RFC6265}}, allowing one site access to information and
+actions that are intended to be restricted to a different site.
+As QUIC runs over UDP, the primary attack modality of concern is one where an
+attacker can select the address to which its peer sends UDP datagrams and can
+control some of the unprotected content of those packets. As much of the data
+sent by QUIC endpoints is protected, this includes control over ciphertext. An
+attack is successful if an attacker can cause a peer to send a UDP datagram to
+a host that will perform some action based on content in the datagram.

The Message Send Service (RFC 1312) seems like a potential target.

>    This service is primarily intended for "open" environments:
>   controlled local area networks used by reasonably trusted
>   participants, in which security considerations may be relaxed in the
>   interests of ease of use and administration. In such an environment
>   it is appropriate to trust the user name and source IP address as
>   identifying the actual sender of the message.

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: