Click my link and I will probably access your jumeiyou account.

Source: Internet
Author: User

Click my link and I will probably access your jumeiyou account.

Click my link and I will probably access your jumeiyou account

The Weibo login request bound to jumeiyou product is
 

Http://passport.jumei.com/ I /extconnect? Site_name = sina_weibo & redirect = http % 3A % 2F % 2Fi.jumei.com % 2Fi % 2 Faccount % 2Fsync_share



This request is not protected by csrf. Attackers can forge this request on a third-party webpage.

Sina Weibo's authorization has the following features: if the current Weibo account has authorized jumei.com, it will be automatically bound

Therefore, we can find a csrf vulnerability for Sina Weibo login to allow users to automatically log on to the attacker's Weibo (sina has such a vulnerability, which is not detailed here)

Then let the user access the Binding Request to complete binding to the attacker's Weibo. Attackers can use Weibo to log on to the user's jumei.com account.
Recorded videos

Http://v.youku.com/v_show/id_XMTQxNzEzNjgxNg==.html

Password 198625

Solution:

Added csrf Protection

Weibo binding forces login using the Weibo user name and password.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.