https://moza369.github.io/tags/csrf/Recent content in Csrf on MOZAHugoen-usThu, 17 Jul 2025 00:00:00 +0000https://moza369.github.io/writeups/csrf-car-marketplace/Thu, 17 Jul 2025 00:00:00 +0000https://moza369.github.io/writeups/csrf-car-marketplace/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Car marketplace platform</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>CSRF + IDOR</td> </tr> <tr> <td><strong>Reports</strong></td> <td>2 separate findings</td> </tr> <tr> <td><strong>Status</strong></td> <td>Triaged</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>While testing a car marketplace platform, I noticed the endpoints for managing car listings had no CSRF protection at all. No tokens, no SameSite cookies, no origin validation — nothing.</p> <p>I found two separate attack vectors, both exploitable with a simple HTML page.</p> <h2 id="vulnerability-1--modify-other-users-car-listings">Vulnerability 1 — Modify Other Users&rsquo; Car Listings</h2> <p>This one was a CSRF combined with an IDOR. The endpoint for editing car listings accepted a <code>carId</code> parameter, but <strong>never verified that the authenticated user actually owned that car</strong>.</p>https://moza369.github.io/writeups/csrf-missing-protection-editor/Mon, 14 Jul 2025 00:00:00 +0000https://moza369.github.io/writeups/csrf-missing-protection-editor/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Web application editor (<code>/editor/*</code>)</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Cross-Site Request Forgery (CSRF)</td> </tr> <tr> <td><strong>Severity</strong></td> <td>High</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> <tr> <td><strong>Reported</strong></td> <td>2025-07-14</td> </tr> <tr> <td><strong>Resolved</strong></td> <td>2025-09-10</td> </tr> </tbody> </table> <h2 id="overview">Overview</h2> <p>A state-changing API endpoint under the application&rsquo;s editor interface had <strong>no CSRF protection at all</strong>. This allowed an attacker to craft a simple HTML page that, when visited by a logged-in user, would silently create or modify data in the victim&rsquo;s account without any interaction.</p> <h2 id="the-vulnerability">The Vulnerability</h2> <p>The endpoint:</p>