To check whether the CSRF token is appearing you will need to look into the HTML source for something like:

<input id="csrf_token" name="csrf_token" type="hidden" value="<TIMESTAMP>:<HASH>" />

Where <TIMESTAMP> is something like 1573375123 and <HASH> is something like 0123456789abcdef0123456789abcdef.  You will need to have at least reloaded Apache (e.g. apachectl graceful) for the addition of EPRINTS_PATH/archives/ARCHIVE_NAME/cfg/cfg.d/csrf_protection.pl to be applied to you running configuration.  The HTML shown above will only appear in forms if you are logged in as a user.  So will not appear in the actual login form (/cgi/users/login) or the search forms (/cgi/search/simple or/cgi/search/advanced) unless you are logged in.  CSRF protection only applies when an authenticated user is trying to make a request, as they would likely have permissions that an unauthenicated user may not.

One thing that should be noted is that staticly generated abstract pages will not contain csrf_token's for their export forms.  This is because these exports do not require user authentication and as the page and subsequently the form are generated without the concept of a user being logged in the forms will not get a csrf_token.  I guess this would cause an uninformed vulnerability scanner to report an error.  Either you should add an exception to your scanner or if it is still a concern (although I believe it causes no security risk) remove the tools box from your abstract page configuration.  I would usually add the following line to ARCHIVENAME/cfg/cfg.d/plugins.pl:

$c->{plugins}{"Screen::EPrint::Box::Tools"}{params}{disable} = 1;

Before reloading Apache, you will need to run:

EPRINTS_PATH/bin/epadmin refresh_abstracts ARCHIVE_NAME

Hopefully this is helpful.  There may be other places where read-only forms like abstract page export exists that could record an error in your vulnerability scanner.  If you could report specific pages and the specific action URLs of the forms that is reporting the vulnerability, I can take a look.  If it is something that effects a whole class of pages like the abstract page situation I described, a single example should be sufficient for me to investigate.

Regards

David Newman

On 10/11/2019 05:24, Maher Abdellatif Ahmad Qahwash wrote: