| タイトル | Kodbox 1.64 Improper Access Controls |
|---|
| 説明 | kodbox’s OAuth integration contains a critical logic flaw. The login API user/index/loginSubmit accepts a client-supplied third JSON and uses only the type/unionid pair to look up a binding in the database and log the user in, without verifying any real OAuth callback, signature, state, or nonce. Separately, the plugin/oauth/bind&method=bind endpoint—CSRF-exempt and lacking server-side verification—allows an authenticated session to bind any attacker-chosen openid/unionid to its account.
By first binding their own unionid to a victim (e.g., via CSRF or any authenticated access) and then, from an unauthenticated context, submitting a forged third JSON containing that unionid, an attacker can reliably log in as the victim, including the root administrator. The fix requires rejecting raw client third data, validating all OAuth identities via trusted server-to-server flows, enforcing CSRF protection and POST-only on bind operations, and adding strong verification and auditing around unionid bindings. |
|---|
| ソース | ⚠️ https://vulnplus-note.wetolink.com/share/IJW1LjsyomCQ |
|---|
| ユーザー | vulnplusbot (UID 96250) |
|---|
| 送信 | 2026年03月09日 04:26 (7 月 ago) |
|---|
| モデレーション | 2026年03月22日 12:40 (13 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 352426 [kalcaddle kodbox 1.64 loginSubmit API index.class.php third クロスサイトリクエストフォージェリ] |
|---|
| ポイント | 20 |
|---|