931065 - possible clickjacking in webfwd.org

Status: RESOLVED INCOMPLETE

(Websites :: Other, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Date: Thu, 24 Oct 2013 22:56:54 +0530
Subject: Reporting a serious vulnerability in your respective domain webfwd.org
From: Ravindra Singh Rathore <[e-mail]>
To: [e-mail]
-----//-----
Hello there

I am Ravindra Singh, a security researcher from India and i have found a very serious vulnerability in one of your domains webfwd.org. And the vulnerability is clickjacking. According to this vulnerability your website can be framed into some other html pages.

-- 
Regards--

Ravindra Singh Rathore
Security Researcher
mail - [e-mail]

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

assigned to dchan for verif

Comment 2

[David Chan [:dchan]]

Hi Ravindra

Can you clarify what the attack is? I can see the XFO is not set on the site. However there is no login functionality / accounts. The whole site should be static aside from the apply page.

Comment 3

[Ravindra Singh]

Hello,

Actually there is an application form on that page for webfwd. And an attacker can fill out this form on behalf of victim.

Comment 4

[David Chan [:dchan]]

Hi Ravindra,

Yes, it is possible for an attacker for fill out the form on behalf of the victim. However you don't need missing XFO or CSRF for this type of attack to work. A malicious user can always go to the site and fill out the form with any details they want.

Is there some other attack you were thinking of?

Comment 5

[Ravindra Singh]

Hello David,

There are many possibilities for this and missing XFO is one of them.

Comment 6

[David Chan [:dchan]]

(In reply to Ravindra Singh from comment #5)
> Hello David,
> 
> There are many possibilities for this and missing XFO is one of them.

Hi Ravindra,

The bounty committee has decided not to pay out on this bug. The site is missing XFO as you mention, however there isn't functionality on the site which can be abused in a clickjacking attack.

Please let us know if we are overlooking something in your report and we will evaluate the bug again.

Comment 8

[u597032]

Website is no longer active