CSRF Attack on (m.badoo.com)deleting account and erasing imported contacts

How it was found

Hello ,

Summary :-

I would like to report a Csrf bug that i found today that can cause deletion of any victim's account and also I was able to erase all imported contacts of victim on sub-domain--->m.badoo.com .

When attacker send a crafted malicious html file to victim and as soon as the victim opens the file and clicks on submit button(I m using submit button for demonstration purposes) , a delete POST request is made to m.badoo.com and the account of victim gets deleted. In a much similar way i was able to make an html file that when opened up by victim would erase victim's all imported contacts. (Note--->victim must possess an active session).

Reproduction steps :-

Basically when i was capturing the request and response http headers in burpsuite , it basically caught my eye that there was no use of csrf token being implemented here, so I crafted two html files one for erasing imported contacts and another one for deleting accounts on m.badoo.com . Also , as the content-type was json so parser introduced "=" at the end of content in header, but it was bypassed by adding "ignore_me":"' value='test".

1. Create 2 html files one for deletion and one for erasing contacts(both files have been attached) 2)send the html file to victim(victim should have an active session) 3)after clicking the submit button in both the html files , one will lead to deletion and other one erasing victim's contacts.

Below images describe the results :-

1. results of deleting account --->

{F144646}

2. results of erasing contacts --->

{F144647}

Attack Scenario and Patch :-

Attack scenario can be critical as an attacker would be able to delete and erase contacts of any person who has an account on m.badoo.com sub domain . Patch for the above scenario can be using CSRF token that must be random and keep on changing for every outgoing request to m.badoo.com

Proof-Of-Concept:-

I have attached html files , image poc for the above attack scenario

Video PoC demonstration :- I have uploaded an unlisted video on youtube , here is a link :- https://youtu.be/rWm1RGXyK7I

regards tikoo_sahil