How do I brush Sina Weibo fans?

1. small-scale tests show that more than 500 followers are listed. 2. this site is not fortified with CSRF, And the GET method is directly used to add attention and messages, which can lead to CSRF worms; 3. I want to share a story about how Internet vendors can kill CSRF attacks in seconds.
1. First of all, I declare that I just tested and refreshed more than 500 fans of wooyun, But I didn't continue. I can do the CSRF worm! I'm a good boy! 2. Let's get started. The problematic site is: tw.weibo.com, which does not defend against CSRF, but does not set any precaution for adding or removing attention, sending Weibo posts, or leaving messages. I will give two examples below: 3. The following interfaces are added: http://tw.weibo.com/api/addfriendship/?uid= For a GET request, the uid parameter is the uid of the object to be followed, and the uid of wooyun is: 1981622273. Then, Weibo users can follow wooyun Weibo after accessing the following link in any way: http://tw.weibo.com/api/addfriendship/?uid= 19816222734. method 1: cooperate with social engineering to trick Weibo users into clicking the above link. Of course, there must be a platform for Weibo users to click. You can send the above link through QQ and other chat software to trick users into clicking, but I don't think it's a big problem, and it's very troublesome! In fact, Weibo itself is such a platform. I directly Insert the link: Click [Publish]. Of course, you can match other literary texts for better results! Generate a short connection as follows: when a user who does not follow wooyun Weibo clicks, the following results are successfully added: 5. method 2: method 1 requires users to click. Today, no one is a fool, and the success rate may be low. If there is a way to load it directly, the victim will pay attention to wooyun after reading my Weibo! Do you still remember the 401-based authentication-based phishing panic triggered by @ imlonghao? Load it directly through the element! However, Weibo itself cannot directly insert network connections. Generally, images must be uploaded to the Sina server. On that dark night, I made a good friend @ th000 to find a subdomain on Weibo that can insert network connections at the cost of three war3: http://game.weibo.com Check that although the local client has verified whether the network connection request is an image, this is indeed a small case for white hats. Well, fans use this brush: 6. okay. The problem of Fan refresh is over! Below is where worms may be triggered. Weibo (I didn't test haha). I read the message and didn't prevent CSRF. What's so scary is that it is also a GET request method! See the following request: http://tw.weibo.com/api/addcomment/?mid=3534023949539660&comment=so+nice&_=1358063650295 The preceding two methods take effect immediately upon access! Of course, if you select [forward to Weibo at the same time], the weibo.com homepage will also suffer from worms!

7. I have shared this article with major Internet manufacturers to prevent CSRF faults. I have already mentioned it clearly. I wonder if you have noticed it. This is the use of Weibo. For GET requests, it is ineffective to verify that the referer does not add a token to the CSRF! For example, the above click on the fan's link to prevent CSRF, verify the referer, put it under weibo.com by using the method 1 or 2, and the victim clicks, is the requested referer still weibo.com?
 Solution:

I hope the vendor does not reply: Thanks for your feedback. The problem has been detected internally and the relevant owner has been notified to fix it.