1

I found the following behavior on a relatively popular website:

  1. They have a GET route for logging out (e.g. /api/user/logout).
  2. That allows me to write ![](/api/user/logout) in a comment or anything that accepts markdown and that will obviously log out the user.

The fix for this bug would be not using GET (but using POST or DELETE or something similar) for the logout route.

What is the name of this type of exploit? Is it an important issue?

Improve this question
1
  • @SilverlightFox Mostly yes, I saw it after finding out we're talking about CSRF. :) When I posted the question I had no idea what is the name of this thing.
    – Ionică Bizău
    Commented Feb 18, 2016 at 9:18

1 Answer 1

Reset to default
3

This is called CSRF, or Cross-Site Request Forgery. Logging a user out through CSRF is a much-discussed issue in the security community. Some view it as a non-issue (see Google's stance: https://sites.google.com/site/bughunteruniversity/nonvuln/logout-xsrf). Others view it more of a nuisance.

However, I have to respectfully disagree with Google's stance. It is easily addressable. Like other CSRF actions, you need a token (so changing it to a POST wouldn't address it) that isn't known or guessable by an attacker. This means you can make the logout link contain a one-time token. This would break attempts to put it in an image or disguise the link some other way.

Improve this answer
3
  • Thanks! In this particular context, I can leave such a comment to a long discussion (where other users are involved) and nobody will be able to comment after me, because when one accesses the page is automatically logged out. :D. What do you think—does it make sense to report it?
    – Ionică Bizău
    Commented Feb 17, 2016 at 5:28
  • That depends on the site if you should report it. Some sites don't appreciate it, others care. If it were my website, I'd want to fix it, if nothing else than to keep from annoying my users.
    – h4ckNinja
    Commented Feb 18, 2016 at 1:03
  • 1
    Reported, validated, I will get some swag from them. :-) Same issue is on PayPal, but they said it's not that important. I also saw that there are bounty programs explicitly saying that the CSRF logout shouldn't be reported. Learned something. :) Thanks once again!
    – Ionică Bizău
    Commented Feb 18, 2016 at 6:22

Not the answer you're looking for? Browse other questions tagged .