Kallithea Security Notice CVE-2015-0276

Lack of CSRF attack protection enables gaining unauthorised access to users' accounts

Synopsis

A vulnerability has been found in Kallithea, allowing attackers to gain unauthorised access to account of a logged in user.

Description

Pages presenting forms to the user and accepting user's input don't provide synchronisation tokens to prevent cross-site request forgery.

It is possible to change an email address of a user by tricking them into clicking a link that initiates the following HTTP request:

POST /_admin/my_account HTTP/1.1
Host: <DELETED>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://burp/show/1
Cookie: kallithea=<DELETED>
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 146

username=myAccount&extern_name=kallithea&extern_type=kallithea&firstname=myFirstname&lastname=myLastname&email=emailAddress%40example.com&save=Save

After this, the attacker can request a password reset, the link is then sent to their new email address. Then the attacker changes the email address back to the original, and doesn't log out, saving the cookie.

At this point, the attacker has full access to the user's account. The user can't login (the password has changed), but might think that he forgot their password, has an account lockout, or an expired account. The user does a password reset, but the attacker still has the access.

Impact

The vulnerability allows attacker to steal account of an active user by using social engineering techniques. In the case the user also has administrator rights, it is possible for the attacker to gain full administrator access to the Kallithea instance.

Resolution

Kallithea project has fixed this issue by adding CSRF checks to the form generation code. Before the fix, there none of the forms had CSRF protection, with the fix, all POST forms are protected against CSRF.

There's no fix as a standalone patch, however; instead, it is recommended to upgrade to the latest 0.2 release which includes lots of other changes and improvements.

Affected versions

The issue is currently present in all Kallithea versions before 0.2.

Acknowledgments

Thanks to Paul van Empelen for reporting this issue.

References

  1. CVE-2015-0276 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0276

  2. Kallithea: Security Notice CVE-2015-0276 https://kallithea-scm.org/security/cve-2015-0276.html