Description ----------- The current version (1.5.5) of the official jsConnect plugin allows the takeover of an existing account that wasn't created using SSO - eg a previously existing admin user - by registering an account with the same name using SSO. A successfull attack requires one request to be issued by an authenticated administrator. This can for example take place via CSRF. Other than this, the attacker does not need any special permissions. POC --- 1. Prerequisit: Enable jsConnect and add an SSO service (eg a local WordPress instance using the Vanilla WordPress plugin). Add a user - eg `admin` - in Vanilla, eg using `vanilla-core-2-6/dashboard/user` -> "Add User" (or use the admin user which was created on installation). 2. Attacker: Register a user with the same name and an arbitrary password in the SSO service (eg WordPress). 3. Attacker: Register with Vanilla using SSO, using the credentials from step 2. After authenticating with the SSO service, Vanilla will say that the username is already taken. Clicking on "Connect" will issue a POST request. The response will inform the attacker that a password is required. 4. Attacker: Create a CSRF payload for the previous POST request and send it to an authenticated administrator. 5. Victim Admin: Execute the CSRF payload. 6. Attacker: Sign in using SSO. Use the credentials for the account of the SSO service created in step 2. The attacker will now have access to the account that was created in step 1, without having had access to the password for that account. Example CSRF code: The values would of course need to be adapted, but are all known to the attacking user. I haven't looked into it in-depth yet, but my assumption is that the vulnerable code is actually in Vanilla core, likely in `applications/dashboard/controllers/class.entrycontroller.php:connect()`, so other functionality outside of the jsConnect plugin may be affected as well. ## Impact Takeover of Vanilla account.