HackerOne #6910 — CSRF Allowing Attacker to Remotely Change Any User's Area Code on Siklu

Source: HackerOne Report #6910

Vulnerability Summary

A CSRF vulnerability on siklu.com allowed an attacker to change any authenticated user's area code setting without their knowledge or consent. The vulnerability existed because the account settings endpoint lacked proper CSRF token validation.

Technical Details

The vulnerability was located in the user account settings page where users can modify their phone area code preferences. The form submission endpoint did not validate:

• CSRF tokens (synchronizer token pattern missing)
• SameSite cookie attributes
• Origin/Referer header validation

An attacker could craft a malicious webpage that, when visited by a logged-in Siklu user, automatically submits a request to change the user's area code to a value chosen by the attacker.

Impact

• Misdirected calls: Users receive calls intended for different regions
• Caller ID spoofing facilitation: Changed area codes can make calls appear to originate from different locations
• Phishing enablement: Attackers can make phishing calls appear more legitimate by matching the target's expected area code
• User confusion: Legitimate calls may be missed due to area code mismatches

Remediation

The vulnerability was resolved by implementing proper CSRF protection:

1. Added synchronizer CSRF tokens to all state-changing requests
2. Implemented SameSite=Strict cookie attributes
3. Added Origin and Referer header validation as a defense-in-depth measure

Key Takeaways for CSRF Defense

• CSRF tokens should be unique per session and per request
• SameSite cookie attribute is an effective additional layer
• State-changing endpoints (POST, PUT, DELETE, PATCH) must always validate CSRF tokens
• GET requests should never perform state-changing operations