619932 - getpersonas has a cross site request forgery vulnerability in upload form

Status: VERIFIED FIXED

(Websites Graveyard :: getpersonas.com, defect)

Description

[gabriel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.10) Gecko/20050716
Build Identifier: https://www.getpersonas.com/en-US/upload

In the url:
https://www.getpersonas.com/en-US/upload
It is vulnerable to a Cross Site Request Forgery attack (CSRF).
The example below shows the post data without the binary code of the images:

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="agree"



1
-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="license"



restricted

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="id"





-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="name"



teste_gab

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="textcolor"



b53636

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="header-image"; filename="green2.jpg"

Content-Type: image/jpeg


-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="description"



descricao do garoto

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="category"



Sports

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="accentcolor"



632d2d

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="footer-image"; filename="green3.jpg"

Content-Type: image/jpeg


-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="reason"



fun

-----------------------------457226728227790211288379351

Content-Disposition: form-data; name="other-reason"





-----------------------------457226728227790211288379351--


There is no check or token to verify the message.


Reproducible: Always

Comment 1

[Wil Clouser [:clouserw]]

Same fix as the other bug

Comment 3

[Daniel Veditz [:dveditz]]

(In reply to comment #1)
> Same fix as the other bug

Meaning "fixed by" the other bug, or just that we need to do the same thing in a new place?

Comment 4

[Wil Clouser [:clouserw]]

same thing in another place

Comment 5

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to comment #4)
> same thing in another place

Assuming referring to bug 619932 and "same thing" is the required fix.

Comment 6

[Wil Clouser [:clouserw]]

Not sure why I was so cryptically vague here.  I think the other bug is the user profile page one.

Comment 8

[Daniel Veditz [:dveditz]]

bad things you can do:
- swamp our reviewers
- frame someone for offensive images
- get them banned (for spam or offensiveness)
- generally DoS our server while hiding your tracks.

Not critical, but needs to be fixed.

Comment 9

[Daniel Veditz [:dveditz]]

apparently we "knew" after bug 619256 that we needed to fix more than that one form, but in the absence of any evidence (bugs filed, or comments in an existing bug, plans on a wiki,...) it looks like gabriel beat us to it and IMHO should be awarded a bounty.

WebDev needs to document any other similar pages if they're aware of them.

Comment 10

[Daniel Veditz [:dveditz]]

clouser filed bug 624597 to cover any remaining issues.

Comment 11

[Toby Elliott [:telliott]]

Attachment: Nonces the upload process

Comment 12

[Barry Chen]

Comment on attachment 508834 [details] [diff] [review]
Nonces the upload process

The only minor issue I can think of is that since only one nonce value is stored in the user session, if the user opens another form in another tab/window, the previous nonce would be overwritten.

Comment 13

[Wil Clouser [:clouserw]]

Thanks Barry.  Toby, please land

Comment 14

[Toby Elliott [:telliott]]

Landed in 81985

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

TOS:
                    <h3>Terms of Service</h3>
                </div>
               <form action="https://personas.stage.mozilla.com/en-US/upload" method="post">
               <input type="hidden" name="nonce" value="XFI0FgqQV7rZ7k1Iyfrg1I7hgHqiT50qB">

               <input type="hidden" name="firstterms" value="1">

Create your persona:

                <h4>Create Your Persona</h4>
                <form method="POST" action="https://personas.stage.mozilla.com/en-US/upload" enctype='multipart/form-data'>
                <input type="hidden" name="nonce" value="OQiEROw9Rr1VAoLZu6zoO1kuhl5SG60UN">

I also saw in the patch commit that there's an SSC template to which the nonce was added, but I forget how to access it, and it's a one-off thing anyway.

Verified FIXED.