HexBrain
Open on HackerOneSign in

Unikrn · Report #339352

CSRF logs the victim into attacker's account

Validstatus
mediumseverity
16upvotes
19 Apr 2018disclosed

How it was found

Description: There is no session validation while logging in which leads to csrf.

Steps To Reproduce:

  1. Create a CSRF login POC using the following code.
<html> <body> <form action="https://unikrn.com/apiv1/login" method="POST"> <input type="hidden" name="usr" value="[email]"> <input type="hidden" name="pwd" value="[password]"> <input type="submit" value="Submit request" /> </form> </body> </html>
  1. Replace the email and password with the valid credentials.
  2. Send the script to the victim to make them click.

References:

  1. You've rewarded a guy for login csrf here: https://hackerone.com/reports/293016
  2. Impact of login csrf on a company: https://support.detectify.com/customer/portal/articles/1969819-login-csrf

Impact

  1. Log any victim into the attacker account, the attacker can create a similar account profile as the victim - with some information missing, and then social-engineering (e.g. email) user to provide personal information or current password and can also monitor the victim activities.
  2. Also the victim may add his paymet info in the attackers account unknowingly using your wallet feature.

The hacker selected the Cross-Site Request Forgery (CSRF) weakness. This vulnerability type requires contextual information from the hacker. They provided the following answers:

URL https://unikrn.com/apiv1/login

Verified Yes

Can a victim be forced to perform a sensitive state-change operation unknowningly? Yes

What state-change operation can be performed? Any user details.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original