Severity: Medium

Description: DataFlux Data Management Server 2.9 REST APIs contain a CSRF vulnerability.

Potential Impact: An attacker might cause information to be submitted to a vulnerable application on behalf of a valid user.

Click the Hot Fix tab in this note to access the hot fix for this issue.

*An additional patch is required for DataFlux Secure. To obtain the DataFlux Secure patch, contact SAS Technical Support and reference this SAS Note. 

Instructions for Enabling CSRF protection for DataFlux Data Management Server:

After applying any relevant patches for this issue, complete the following steps to enable CSRF protection:

1.  Navigate to the etc directory of the root install location.

2.  Edit the dmserver.cfg file and add the following configuration option to enable CSRF protection as shown below:

# CSRF protection
DMSERVER/REST/CSRF_PROTECTION=yes

3.  Restart the DataFlux Data Management Server service in order to load the changes.

4.  Once CSRF protection is enabled for DataFlux Data Management Server, update all API calls using authorization to include a valid eTag in the header. It is important to note that all requests missing a valid eTag will fail with HTTP 401 (Unauthorized). For details on this topic, see the DataFlux Data Management Server 2.9: REST API Reference located in the \doc\rest_api\ directory of the root install. After opening the Default.htm file in a browser, enter "Cross-Site Request Forgery Protection" in the search.

Operating System and Release Information

A fix for this issue for DataFlux Data Management Server 2.9 is available at: