2. Mailing Lists
  3. in
  4. Vulnerability Report 03:No CSRF protection on login

Archives

Vulnerability Report 02: Failure to invalidate session on Password Change

New List OF UK USA Blogs Just $80/Post

Vulnerability Report 03:No CSRF protection on login

Vulnerability: No CSRF protection on login. 

Level: Critical

Description:
The login form is not protected against Cross-Site Request Forgery.
An attacker can craft an HTML page containing POST information to have the victim sign into an attacker's account, where the victim can add information assuming he/she is logged into the correct account, where in reality, the victim is signed into the attacker's account where the changes are visible to the attacker. The real issue here is that when the victim runs the HTML Proof of Concept, the account is logged in to the attacker without any visible warnings, thus the victim is capable of theft of data and potentially vulnerable to account takeover.

Steps to reproduce:
1. Create a victim account. (Google Chrome)
2. Create an attacker account. (Firefox)
3. Now intercept the attacker browser's request and save it as . HTML. 
4. Now run that POC in the victim's browser and press submit.
5. On the victim's browser, he/she is logged in as an attacker without any indication unless the page is manually refreshed.

Proof of concept: 

<html>
  <body>
    <form action="https://www.odoo.com/web/login" method="POST">
      <input type="hidden" name="utc&#95;offset" value="&#45;300" />
      <input type="hidden" name="email" value="abul37772&#64;gmail&#46;com" />
      <input type="hidden" name="password" value="Testing123&#64;&#35;&#36;" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

Mitigation:
You are using an authenticity token to prevent this but it is not validating so add a valid CSRF token and token verification method to the login request or make some type of prompt that the session has ended when the new login from the attacker occurs.

If you have any questions, please feel free to contact me. I'll be more than happy to assist you.

I look forward to hearing from you soon 

Thanks and Regards
Team Star jet Cyber,
Afshan
by "starjet cyber" <starjetcyber22@gmail.com> - 10:19 - 12 Aug 2024