ownCloud: The csrf token remains same after user logs in

2016-01-17T15:23:57
ID H1:111262
Type hackerone
Reporter mrsihag
Modified 2016-02-25T21:13:44

Description

As the CSRF token doesn't change after login. Any other user that uses the same workstation is vulnerable. A safer way would be to use dynamic CSRF token or just change the token after login, so attacker doesnt get hold of this.

Details of the attacks scenario in a shared workstation environment

1.The attacker simply copies the authenticity token. This token is the only protection against the CSRF attack.

2.Any other user that uses the workstation after that is vulnerable to CSRF. The attacker simply needs to craft a link with the required GET or POST method as he already have the CSRF token and send it to the victim via email, chat etc.

3.The attacker can trick the victim in doing anything he wants without the user being aware of it.

In the most basic sense the attacker has an authenticity token of another user which he shouldn't have had in the first place.