PortSwigger Web Security · Report #186862
Order-phishing via Payment ID URL
Summary
The issue discovered was trivial, and did not present much security impact (as the form was available for anonymous users).
It was one of the my early reports here (my 1st week on H1 with zero knowledge), with a lot of technical mistakes, so enjoy the reading :D. Here is the funniest quote:
Basically it is not usual CSRF, but modified kind of CSRF (with GET scenario, since the POST scenario not works due to X-Frame-Options set to SAMEORIGIN)
{F3614319}
Thanks to @albinowax for being patient with me. It was very important for me in those early days
How it was found
Hello. I discovered the endpoint, which allows the attacker conduct the fishing attack to other users and they can pay for attacker's order. Why this can happen? On the site, order id parameter sends to the https://portswigger.net/CCPayment.aspx as POST, but attacker can append it as GET and it will works:
Example: https://portswigger.net/CCPayment.aspx?id=DD6BE85CDD50DC829C0354F83E5C67
Steps to reproduce:
- Go to the https://portswigger.net/buy/ and fill the form.
- Click "Confirm details".
- Click "Pay by credit card".
- Catch the POST request from ССpayment.aspx with order id:
POST /CCPayment.aspx HTTP/1.1 [...Headers...]
id=05BC4BF36F9BB32E80F4B581BF4859
- Now append the id as GET parameter. You will have link like https://portswigger.net/CCPayment.aspx?id=05BC4BF36F9BB32E80F4B581BF4859
- Now you can conduct phishing attack with this link, and users can pay for your order.