Click my link and I will probably access your jumeiyou account.

Click my link and I will probably access your jumeiyou account.

Click my link and I will probably access your jumeiyou account

The Weibo login request bound to jumeiyou product is
 

Http://passport.jumei.com/ I /extconnect? Site_name = sina_weibo & redirect = http % 3A % 2F % 2Fi.jumei.com % 2Fi % 2 Faccount % 2Fsync_share

This request is not protected by csrf. Attackers can forge this request on a third-party webpage.

Sina Weibo's authorization has the following features: if the current Weibo account has authorized jumei.com, it will be automatically bound

Therefore, we can find a csrf vulnerability for Sina Weibo login to allow users to automatically log on to the attacker's Weibo (sina has such a vulnerability, which is not detailed here)

Then let the user access the Binding Request to complete binding to the attacker's Weibo. Attackers can use Weibo to log on to the user's jumei.com account.
Recorded videos

Http://v.youku.com/v_show/id_XMTQxNzEzNjgxNg==.html

Password 198625

Solution:

Added csrf Protection

Weibo binding forces login using the Weibo user name and password.