[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20150410192855.59f7c8c5@ileemo>
Date: Fri, 10 Apr 2015 19:28:55 +0200
From: Andrew Shadura <andrew@...dura.me>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-0276: Kallithea: Lack of CSRF attack protection enables
gaining unauthorised access to users' accounts
Hello,
We have recently discovered a security issue in Kallithea [0].
API key of repository's creator is exposed by get_repo API method.
Synopsis
========
A vulnerability has been found in Kallithea, allowing attackers to gain
unauthorised access to account of a logged in user.
Description
===========
Pages presentings forms to the user and accepting user's input don't
provide synchronisation tokens to prevent cross-site request forgery.
It is possible to change an email address of a user by tricking them
into clicking a link that initiates the following HTTP request:
POST /_admin/my_account HTTP/1.1
Host: <DELETED>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:35.0)
Gecko/20100101 Firefox/35.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
Referer: http://burp/show/1
Cookie: kallithea=<DELETED>
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 146
username=myAccount&extern_name=kallithea&extern_type=kallithea&firstname=myFirstname&lastname=myLastname&email=emailAddress%40example.com&save=Save
After this, the attacker can request a password reset, the link is then
sent to their new email address. Then the attacker changes the email
address back to the original, and doesn't log out, saving the cookie.
At this point, the attacker has full access to the user's account. The
user can't login (the password has changed), but might think that he
forgot their password, has an account lockout, or an expired account.
The user does a password reset, but the attacker still has the access.
Impact
======
The vulnerability allows attacker to steal account of an active user by
using social engineering techniques. In the case the user also has
administrator rights, it is possible for the attacker to gain full
administrator access to the Kallithea instance.
Resolution
==========
Kallithea project has fixed this issue by adding CSRF checks to the form
generation code. Before the fix, there none of the forms had CSRF
protection, with the fix, all POST forms are protected against CSRF.
There's no fix as a standalone patch, however; instead, it is
recommended to upgrade to the latest 0.2 release which includes lots of
other changes and improvements.
Affected versions
=================
The issue is currenly present in all Kallithea versions before 0.2.
References
==========
[0] Kallithea Project
<https://kallithea-scm.org/>
[1] CVE-2015-0276
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0276>
[2] Kallithea: Security Notice CVE-2015-0276
<https://kallithea-scm.org/security/cve-2015-0276.html>
--
Cheers,
Andrew Shadura
on behalf of Kallithea Security Team
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
