Send Empty CSRF leads to log out user on [https://hosted.weblate.org/accounts/profile]
Low
W
Weblate
Submitted None
Actions:
Reported by
homaa
Vulnerability Details
Technical details and impact analysis
Hi
There is a CSRF bug on your [Website](https://hosted.weblate.org/) leads to logout user from the dashboard.
If the user click on the attached file (CSRF.html) redirect to another page and see the following error and the user log out immediately:
{F1029146}
## Steps to reproduce:
1- Login to your account via [Login page](https://hosted.weblate.org/accounts/login/)
2- Click on CSRF.html that attached.
After that, you will redirect to a new page an see the error, the user after clicking on this file log out from account.
You can see in the CSRF file there isn't any token, but if you place a vaid CSRF token from the source page, this attack will be successful too.
{F1029164}
If you have any questions, please let me know.
Best.
## Impact
An attacker can send the CSRF file to the victim or host it on a website. Whenever the user login in to your website click on file or link will be logged out.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-Site Request Forgery (CSRF)