1157395 - CSRF in log in form

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[Mario Gomes]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36

Steps to reproduce:

Hi,

It seems CSRF login that had been reported a long time ago: https://bugzilla.mozilla.org/show_bug.cgi?id=713926

Is this an intentional behaviour??

This vulnerability could allow attackers to unlog logged users and log into attacker's account, through this trick, victim will think she's still logged in her account then possibly report a security bug while logged in attacker's account.

Poc: https://bugzilla.mozilla.org/index.cgi?Bugzilla_login=netfuzzer%40yandex.com&Bugzilla_password=Mariogomes11&Bugzilla_remember=on&GoAheadAndLogIn=Log+in

Cheers,
Mario

Comment 1

[Mario Gomes]

Hi,

It seems CSRF login that had been reported a long time ago: https://bugzilla.mozilla.org/show_bug.cgi?id=713926 
It is still working. Is this an intentional behaviour??

This vulnerability could allow attackers to unlog logged users and log into attacker's account, through this trick, victim will think she's still logged in her account then possibly report a security bug while logged in attacker's account.

Poc: https://bugzilla.mozilla.org/index.cgi?Bugzilla_login=netfuzzer%40yandex.com&Bugzilla_password=Mariogomes11&Bugzilla_remember=on&GoAheadAndLogIn=Log+in

Cheers,
Mario

Comment 2

[Frédéric Buclin]

We said in the security advisory that the CSRF protection was not backported to 4.2 and 4.0 on purpose. Mozilla Bugzilla is still running 4.2.

Comment 3

[David Lawrence [:dkl]]

We did backport it though to bmo/4.2

https://git.mozilla.org/?p=webtools/bmo/bugzilla.git;a=commitdiff;h=4e1941f [github]

So why is this til failing to protect against csrf? Investigating.

Comment 4

[:glob ✱]

gah, bug 1090427 was backed out in bug 1093622, but wasn't put back when that bug was wontfix'ed.
dkl, the backport patch no longer applies, are you able to update that patch and attach it here for a quick re-review?

Comment 5

[David Lawrence [:dkl]]

(In reply to Byron Jones ‹:glob› from comment #4)
> gah, bug 1090427 was backed out in bug 1093622, but wasn't put back when
> that bug was wontfix'ed.
> dkl, the backport patch no longer applies, are you able to update that patch
> and attach it here for a quick re-review?

Yeah. Will do this first thing.

dkl

Comment 6

[Mario Gomes]

Is there any chance this bug be eligible for a bug bounty?

Comment 7

[:glob ✱]

(In reply to Mario Gomes"''><Img src=x onerror=prompt();> from comment #6)
> Is there any chance this bug be eligible for a bug bounty?

probably not -- the bug 713926 is marked as sec-low.
but i'll leave it up to the security team to decide.

Comment 8

[Mario Gomes]

Yea -  I noticed that. I'll have to find something more interesting!

(In reply to Byron Jones ‹:glob› from comment #7)
> probably not -- the bug 713926 is marked as sec-low.
> but i'll leave it up to the security team to decide.

Comment 9

[David Lawrence [:dkl]]

Attachment: 1157395_1.patch

Comment 10

[David Lawrence [:dkl]]

Comment on attachment 8596575 [details] [diff] [review]
1157395_1.patch

Need new patch that incorporates fixes from bug 1001497 and bug 1132887.

Comment 11

[David Lawrence [:dkl]]

Attachment: 1157395_2.patch

Comment 12

[:glob ✱]

Comment on attachment 8596581 [details] [diff] [review]
1157395_2.patch

Review of attachment 8596581 [details] [diff] [review]:
-----------------------------------------------------------------

r=glob

Comment 13

[David Lawrence [:dkl]]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   ed92da4..283be21  master -> master

Comment 14

[Al Billings [:abillings - ex-MoCo]]

We need a security rating on this. Can you suggest a rating for it?

Comment 15

[David Lawrence [:dkl]]

sec-low

Comment 16

[Mario Gomes]

Any updates related bug bounty decision ??

Comment 17

[Al Billings [:abillings - ex-MoCo]]

No. It was discussed at the bounty meeting today but we have not reached a final decision.

Comment 18

[Al Billings [:abillings - ex-MoCo]]

(In reply to David Lawrence [:dkl] from comment #15)
> sec-low

Can you give the rationale for why this is a sec-low?

Comment 19

[David Lawrence [:dkl]]

(In reply to Al Billings [:abillings] from comment #18)
> (In reply to David Lawrence [:dkl] from comment #15)
> > sec-low
> 
> Can you give the rationale for why this is a sec-low?

Since this was a dupe of bug 713926 that was simply backported to BMO, I assumed it would have the same level of impact. We actually had this applied at one point but it broken one of our critical tools so was backed out.

dkl

Comment 20

[Mario Gomes]

So... still not having the final decision related to  bounty award ??

Comment 21

[Al Billings [:abillings - ex-MoCo]]

(In reply to Mario Gomes from comment #20)
> So... still not having the final decision related to  bounty award ??

It is minused for bounty. As a sec-low severity issue, it isn't eligible.