Re: Users - Hidden partyId - Security Risk?
Posted by
Vinay Agarwal on
URL: http://ofbiz.116.s1.nabble.com/Users-Hidden-partyId-Security-Risk-tp137366p137377.html
My testing did find problem with hidden paymentMethodId field that I am
describing below. In addition, there are 240 other ftl files that contain
hidden fields and may pose security risk although I have not looked at anyone
else.
File:
applications/ecommerce/webapp/ecommerce/customer/editcreditcard.ftl
Statement: <input type="hidden" name="paymentMethodId" value="${paymentMethodId}">
Theory:
A hacked form may change the paymentMethodId and modify data that the
user does not have authorization for
Method:
- Ecommerce application, signed up as “firstuser”
and added a credit card. Its paymentMethodId came out to be 10000.
- Logged out and signed up as “seconduser”
and added a credit card. Its paymentMethodId came out to be 10001.
- Logged in as seconduser, clicked on update credit
card. Saved the html page locally.
- Edited the saved html page
- Changed paymentMethodId from 10001 to 10000.
- Added http://localhost:8443
to the action url.
- Expected result: firstuser and seconduser each
has one credit card.
- Actual result: firstuser had no card and the
second user had 2 cards as seen on the profile page.
Conclusion:
A user is able to modify data that he is not authorized for.
I would like to know if you can reproduce it. I can add it to Jira if
needed.
Regards,
Vinay Agarwal
_______________________________________________
Users mailing list
[hidden email]
http://lists.ofbiz.org/mailman/listinfo/users