620397 - CSRF on creative.mozilla.org

Status: VERIFIED FIXED

(Websites :: creative.mozilla.org, defect)

Description

[Jose A. Vazquez]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier: 

I found a new vulnerability. Cross Site Request Forgery (CSRF) on site:

http://creative.mozilla.org


I'm going to attach a PoC file that triggers the vulnerability.
The issue would allow to change the configuration of users when they visits the site of attacker.

You could solve the issue using a random token for example: it's the usual way to avoid CSRF.

To check the vulnerability you should register/login to site and then, click on my PoC. your configuration change so:

Your Name: 0wn3d
Location: 0wn3d
Website: http://farmofexploits.org
Twitter: @ 0wn3d_twitter
About You: 0wn3d

This is the configuration that i fixed on PoC file.

Regards,
Jose.

Spanish Security Researcher,
http://spa-s3c.blogspot.com/


Reproducible: Always

Steps to Reproduce:
See details
Actual Results:  
See details

Expected Results:  
See details

See details

Comment 1

[Jose A. Vazquez]

Attachment: CSRF Proof Of Concept

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

Wil, Morgamic, 

Who should this be assigned to?

Comment 4

[Michael Morgan [:morgamic]]

Ryan, could you help with this before you take off?

Comment 5

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

CRSF fix put in place.  Using Kohana module updates from Bespin Plugin Gallery.  All auth module pages will need to be tested on stage by QA before release (register, login, logout, change email, change password, forgot password, edit profile).

==

Deleting       application/controllers/auth.php
Adding         application/views/auth
Adding         application/views/auth/email.php
Adding         application/views/auth/emails
Adding         application/views/auth/emails/changeemail_email.php
Adding         application/views/auth/emails/forgot_email.php
Adding         application/views/auth/emails/register_email.php
Adding         application/views/auth/emails/welcome_email.php
Adding         application/views/auth/forgot.php
Adding         application/views/auth/login.php
Adding         application/views/auth/logout.php
Adding         application/views/auth/password.php
Adding         application/views/auth/register.php
Adding         application/views/auth/verify_action_required_email.php
Adding         application/views/auth/verify_action_required_forgot.php
Adding         application/views/auth/verify_action_required_registration.php
Adding         application/views/auth/verify_fail.php
Adding         application/views/auth/verify_reset_password.php
Deleting       application/views/email.php
Deleting       application/views/forgot.php
Deleting       application/views/login.php
Deleting       application/views/password.php
Deleting       application/views/register.php
Deleting       application/views/verify_reset_password.php
Sending        modules/auth/config/routes.php
Sending        modules/auth/controllers/auth.php
Sending        modules/auth/views/forgot.php
Sending        modules/auth/views/login.php
Sending        modules/auth/views/register.php
Transmitting file data ....................
Committed revision 79772.

Comment 6

[Jose A. Vazquez]

I would like to know if something of my stuff could be qualified for reward program...

Comment 7

[Chris Lyon [:clyon]]

(In reply to comment #6)
> I would like to know if something of my stuff could be qualified for reward
> program...

We will be posting to your bugs shortly if any of them qualify. As you know per the FAQ, only selected sites will be considered for the bounty. We do however consider the impact to other areas.

Comment 8

[Jose A. Vazquez]

Ok, thanks for your response.

Comment 9

[krupa raj[:krupa]]

verified that changing the token leads to form-submission failure for

* login
* register
* change email
* reset password

marking this verified.

Comment 11

[Chris Lyon [:clyon]]

@Jose normally this site wouldn't be included in the bounty but you pointed out a issue which we feel needs further review. So we are taking some tasks from this bug and will be doing a deeper dive. So 500 for the bounty, we will be sending an email out shortly. 

We need to review the usage of SSL on this side and CSRF protection.

Comment 12

[Michael Coates [:mcoates] (acct no longer active)]

Attachment: POC from rar

Comment 13

[Jose A. Vazquez]

@Chris thanks! :)