Cross-site request forgery/Confused deputy problem

Hi,

I have been doing some custom development work against nop 3.5 and I think I have found a CSRF vulnerability in the Admin portal.

I have setup a demo site @ http://benevolent-kitten.neocities.org to demonstrate the attack leveraged against the demo admin portal @ http://admin-demo.nopcommerce.com/

The step to reproduce the attack are (note this was tested in Google Chrome);

1) Go to (http://admin-demo.nopcommerce.com/Admin/GiftCard/List) nop demo admin portal and login. (Email:[email protected] Password:admin)
2) Take a note of the gift card count.
3) Go to (http://benevolent-kitten.neocities.org/).
4) Go to gift card list page again (http://admin-demo.nopcommerce.com/Admin/GiftCard/List) and see the new gift card.

The issue here is if a user with authorization to edit gift cards is socially engineered into visiting http://benevolent-kitten.neocities.org/ they will unknowingly create a new gift card. I am sure with a little thought you could engineer a much less benign attack.

Nick

Hi Nick,

Everything works fine. Gift cards cannot be "created" this way. I presume somebody created it manually on your site.

P.S. Please do note duplicate forum topics (deleted)

Hi a.m,

Where you not able to reproduce the issue?

I can send you a video of the attack in action.

Nick

Hi Nick,

I have admin access to several dozens sites powered by nopCommerce. And none of them has this issue.

It's not possible (even theoretically) to create a new gift card record by visiting (simple page open) two sites

By the way if you want to avoid XSRF attack in admin area (although I don't think your example is related to it) please have a look at how it's implemented to registration process (public store) and then implement the same in admin area

1. \Views\Customer\Register.cshtml file - @Html.AntiForgeryToken()
2. \Nop.Web\Controllers\CustomerController.cs - [ValidateAntiForgeryToken] attribute for "Register" method

Hi,

Here is a video of what I am seeing.

https://www.youtube.com/watch?v=k--CmyBI2Lc

Cheers,

Nick

Hi Nick,

Thanks a lot. I thought your site (http://benevolent-kitten.neocities.org/) is just a clean nopCommerce installation. Now I see that you created a form with POST to nopCommerce admin area. Thanks for explanation and video.

In this case my suggestion above should work. I've just created a work item for this task

No worries,

Would you like me to pull the video or keep it up for reference?

Nick

Hi Nick,

Please keep it up. Thanks

Hi,

Here is a pull for 6 controller worth of fixes (CategoryController,CampaignController, BlogController, AffiliateController, AddressAttributeController and ActivityLogController) to resolve the issue.

https://nopcommerce.codeplex.com/SourceControl/network/forks/nickshepherd/xsfradminfixes/contribution/7930

This is a very time consuming task, if my changes here work for you i'll implement the rest.

Cheer, Nick

P.S. This is my first time using Git/CodePlex so let me know if this is the right way to submit code.