地图 / Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’s

Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’s

跨站请求伪造 / 跨站请求伪造 / #361130

厂商: Liberapay
严重程度: 未评级
赏金: —
弱点: 跨站请求伪造
研究员: @mah1ndra
披露日期: 2018-06-04
资产: *.liberapay.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1077 字符中的一小部分）

>We’ve got “Accounts Elsewhere” option in the profile section. where we can connect our liberapay account with multiple other platform accounts.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Liberapay 所有。

时间线

2018-06-02报告提交
2018-06-04公开披露

阅读 HackerOne 原文 ↗作者 @mah1ndra · 版权归作者与 Liberapay 所有

同类报告

[CSRF] TikTok Careers Portal Account TakeoverTikTok · 2020-12-15 CSRF on connecting Paypal as Payment ProviderShopify · 2020-04-10 Account Takeover using Linked Accounts due to lack of CSRF protectionRockstar Games · 2019-02-20 Periscope android app deeplink leads to CSRF in follow actionX / xAI · 2020-02-21 · $1,540 Take over of accounts created using Google or FacebookKhan Academy · 2019-05-17 Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneHackerOne · 2023-06-19