Factlink · Report #13639

X/Csrf token problem

Validstatus

3upvotes

30 May 2014disclosed

How it was found

I found that you are using X/Csrf token as a protection against CSRF attacks.

But you are using same X/Csrf token in and out.

eg z3qrwilV8lz7CXsMhmvqxn+93GDZm/m9w/d5DZjoj8w=

This token is same before and after log-in. This must be patch as it me result session hacks.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original