Loading HuntDB...

CSRF leads to a stored self xss

Low
I
Imgur
Submitted None
Reported by hogarth45

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Reflected
Followup from #311460 #Summary Self xss and CSRF are both out of scope, but when paired it is possible to create an attack on a user. #Description A favorites folder with an xss payload for a name will launch when saving an image to said folder. This can be verified by following these steps * Visit your favorites * Create New Folder * Change name to ``` "'><img src=x onerror=prompt(1)> ``` * Save * Visit a photo * Click the little plus next to the heart on bottom left of image * Add to the folder * xss will launch Since self xss is out of scope, we will need a method of delivering this attack to a user. This can be done via a CSRF to create a favorites folder. # POC Using a form like so to create the CSRF: ``` <html> <body onload='document.forms[0].submit()'> <form method='POST' enctype='application/json' action='https://api.imgur.com/3/folders'> <input name='name' value='New Test"><img src=x onerror=prompt(2)>'> <input name='is_private' value='false'> </form> </body> </html> ``` Or be logged into your imgur account and visit http://blackdoorsec.net/sandbox/imgur2.html This will create the folder with an xss name that can be used to attack an account. ## Impact account hijacking since a user would still need to add an image to the folder for the attack to work, the success rate will be lower than normal #Scenerio since reddit/imgur communities overlap malicious links containing the CSRF could be sent throughout the site. out of the few thousand hits the link would get, i imagine there would be several successful compromised imgur accounts.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cross-site Scripting (XSS) - Reflected