# Boost \_ Shardeum\_ Ancillaries 34367 - \[Websites and Applications - Low] CSRF vulnerability due to mi Submitted on Sat Aug 10 2024 12:56:34 GMT-0400 (Atlantic Standard Time) by @hulkvision for [Boost | Shardeum: Ancillaries](https://immunefi.com/bounty/shardeum-ancillaries-boost/) Report ID: #34367 Report type: Websites and Applications Report severity: Low Target: Impacts: * CSRF vulnerability allowing blackhat to perform authenticated actions * Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as: Email, Password of the victim etc. ## Description ## Brief/Intro The access-token was missing `SameSite=Strict` attribute which leads to CSRF vulnerability resulting in allowing BlackHat to perform authenticated actions. ## Vulnerability Details In `src/routes/authenticate.ts` ``` router.route('/:passphrase').get(async function (req: Request, res: Response) { const { passphrase } = req.params const payload = { user: 'shardeum-dev' } if (passphrase === CONFIG.passphrase) { // token don't expire, usually this is bad practice // for the case being implementing refresh token is overkill // stolen token worst case scenario our debug data ended up being not useful. const token = jwt.sign(payload, CONFIG.secret_key) res.cookie('access_token', token, { httpOnly: false, maxAge: 1000 * 60 * 60 * 700, // ~ a month }) return res.send({ token: token, message: 'authenticated and authorized for debug api calls' }).status(200) } return res.send({ message: 'wrong passphrase' }).status(400) }) ``` After authenticating the rpc server does not define `SameSite=Strict` cookie restriction, which results in allowing malicious websites to call authenticated `GET` API which perform actions like purging tables,modifying config values, node subscription etc. ## Impact Details * The vulnerability allows malicious websites performing actions like purging tables,modifying config values, node subscription etc. * The vulnerability could result in deletion of debug data. ## References ## Proof of concept ## Proof of Concept ``` csrf performing authenticated action

calling /log/cleanTxTable which will trigger purging of table that store transaction logging

click here to attack ``` ## Steps to Reproduce 1. Authenticate to RPC server with password 2. Save the poc file as `csrfpoc.html` 3. Open `csrfpoc.html` from the browser you have authenticated with RPC server. 4. Either click on `Click here to attack` or wait 3 second for attack to happen automatically 5. You will see a response `{"success":true}`