HackerOne #6888 — CSRF Allowing Attacker to Change Settings on Siklu

Source: HackerOne Report #6888

Vulnerability Summary

A CSRF vulnerability on siklu.com allowed an attacker to change user settings without the user's knowledge or consent. The vulnerability existed because the settings update endpoint did not require CSRF token validation.

Technical Details

The settings page allowed users to modify various account preferences. The form submission to update these settings:

• Did not include a CSRF token in the form
• Did not validate the Origin or Referer header
• Relied solely on the session cookie for authentication

A malicious website could contain hidden HTML forms or JavaScript that automatically submits a POST request to the Siklu settings endpoint while the user is logged in. The browser automatically includes the session cookie, making the request appear authenticated.

CSRF Attack Flow

1. User logs into siklu.com and keeps the session active
2. User visits an attacker-controlled website
3. The malicious page contains a hidden form that auto-submits to siklu.com/settings/update
4. The browser sends the request with the user's session cookie
5. Siklu's server processes the settings change as if the user made it

Impact

• Unauthorized settings changes: Attackers can modify user preferences
• Configuration tampering: Changes to security settings, notification preferences, or account configuration
• User experience degradation: Unexpected settings changes confuse users
• Potential for more serious impact: If settings include security-critical options, the impact could be higher

Remediation

The vulnerability was resolved by:

1. Adding synchronizer CSRF tokens to all state-changing forms
2. Implementing token validation on the server side
3. Adding SameSite cookie attributes as additional protection
4. Validating Origin and Referer headers

CSRF Prevention Best Practices

• Use synchronizer tokens — unique, unpredictable tokens per session
• Tokens should be tied to the user session and validated server-side
• SameSite cookie attribute (Lax or Strict) provides browser-level CSRF protection
• For API endpoints, use custom headers that browsers cannot set cross-origin
• Re-authentication for sensitive operations (change password, delete account)