|
Task Description
SUMMARY
The edge filter on security.alwaysdata.com only allows POST to /task/* and
/index.php?do=authenticate. Flyspray dispatches on the "action" field and ignores
the path, so POSTing the profile-edit form to /task/<any id> executes the action.
POST /myprofile -> 403 (blocked by the filter)
POST /task/536 -> 303, change stored (same body, action=myprofile.edituser)
Reproduced on my own account (uid 358) on 2026-10-27, all changes reverted:
real_name -> "Ali Abbas ROUTE" (stored) -> reverted
email -> admin@bugbountyscam.com (stored) -> reverted
STEPS
1. GET https://security.alwaysdata.com/myprofile as a logged-in user; take csrftoken.
2. POST the profile form to /myprofile ⇒ HTTP/2 403 Forbidden.
3. POST the identical multipart body to /task/<any task id>
with action=myprofile.edituser => HTTP/2 303 See Other,
Location: https://security.alwaysdata.com/myprofile
4. Reload /myprofile: real_name and email_address contain the submitted values.
ROOT CAUSE
Filter decision is path-prefix based; application handler selection is based on
the "action" parameter. No component validates that the two agree.
SCOPE OF THE BYPASS
- Every other blocked POST path tested (/index.php, /proj1, /newtask/proj1,
/myprofile) still returns 403; only /task/* reaches the dispatcher.
- Unauthenticated requests have no effect (session check holds, login page).
- user_id=1 / user_id=99999 in the body are ignored - handler always targets the
session user. Group fields (group_in, old_global_id) ignored, server-side only.
So this bypasses the transport filter, not the per-action authorisation.
IMPACT
Any POST route the edge rule is meant to protect can be reached by relabelling
the path as /task/<id>. Persistent writes were demonstrated (profile e-mail and
real name); changing the profile e-mail also changes where account notifications
and recovery messages are delivered.
REMEDIATION
- Enforce the POST allow-list on the dispatched action, not the URL path.
- Reject requests whose "action" does not belong to the route they were sent to.
- Make the dispatcher refuse action processing on controllers that do not
declare that action.
Timestamp: 2026-10-27 18:2x UTC. Testing was manual, own account only, low rate.
|
