I have have started at a new job in Toronto this year, and my first project is an e-commerce website and was tasked to use OpenCart which is the best open source e-commerce software we could find. However an issue I noticed straight away was the application is vulnerable to CSRF attacks via the POST method. Since I take no risks with security I have implemented a fix which generates a token when an admin logs in and appends it to the URL through the Url class.
I have drafted an example of the exploit, sent it to the creator of OpenCart and gave an example of how a user could be targeted with the attacker changing the PayPal email address to their own account. I did this as I didn’t want to publish the exploit until a fix was implemented and a new version was released, but as the following email transcript will show, this is not going to happen anytime soon.
————————————————–
From: “Ben”
Sent: Friday, January 22, 2010 8:06 PM
To: < *******@opencart.com>
Subject: OpenCart – Enquiry
Hi,
I recently installed OpenCart and I noticed that it is vulnerable to CSRF attacks. I have created a sample page that is capable of inserting a rouge user (the page currently prompts you but could be done silently if the attacker knows the url of the site).
http://visionsource.org/*********.html
Please let know that you are looking into the security issue and are going to release an update with a fix otherwise I will make the issue public.
If you need any help fixing the problem please let me know.
Thanks,
Ben.
————————————————–
On 2010-01-22, at 4:50 PM, Daniel Kerr wrote:
Ben you seem to be very clever to come up with this. But! you need to be logged in for this to happen.
————————————————–
From: “Ben Maynard”
Sent: Friday, January 22, 2010 11:34 PM
To: “Daniel Kerr”
Subject: Re: OpenCart – Enquiry
HI Daniel,
That is the whole point of a CSRF attack. Please read http://en.wikipedia.org/wiki/Csrf for an explanation on the attack.
This can be very dangerous, for example:
I am an attacker looking at stealing money, I find a websites that are running opencart and have paypal as a payment method. I send the owner an email asking a question about a product and send a link that will perform the attack on the website. The chances of the owner being logged into their opencart admin is high since they are dealing with orders, and a rouge account is created without the user knowing (The attacker could just format the malicious page to look like a 404 not found page so it doesnt raise suspicion with the owner).
The attacker makes the script send an email when the page is hit, so he knows when to logged into the admin section. The attacker then logs in, changes the paypal email address to his own account, deletes the new account to help cover his tracks. He starts to get the money from the website and the owner of the website may not realize what has happened for a couple of days (maybe even longer)!
If someone was to do this, it would cause a major problem for the owner (and buyers who money was stolen).
I have implemented a fix on the website i am working on and dont mind sharing the fix. I create a random token when the user logs in, and in the Url class I add it to the url. There is also a check on the user auth.
Thanks,
Ben.
————————————————–
On 2010-01-22, at 7:31 PM, Daniel Kerr wrote:
This sort of thing is down to the client. The software on a clients computer is nothing to do with opencart! There is no way that I’m responsible for a client being stupid enough to click links in emails.
Even professional banking sites have trouble with the problem you describe.
The only thing a client can take steps to do is only allowing certain IP’s to access the admin via their hosting.
————————————————–
From: “Ben Maynard”
Sent: Saturday, January 23, 2010 12:52 AM
To: “Daniel Kerr”
Subject: Re: OpenCart – Enquiry
A link in an email is not the only way for this attack to be performed, it was just an example. Its not hard to add protection and would make open cart more secure, security is not something you can take lightly.
————————————————–
On 2010-01-22, at 8:05 PM, Daniel Kerr wrote:
what protection do you recommend?
————————————————–
On 2010-01-22, at 8:05 PM, Daniel Kerr wrote:
to be honest this again is down to the client. not opencart.
the security problem is very low. seriously how is some one going to trick some one into clicking a link to a site that will them display there own web site admin?
your just wasting my time.
Now as you can see, the creator doesn’t care about security which is a very dangerous thing especially when you are creating e-commerce websites. It is also not hard to find websites running OpenCart, you can just google “Powered By OpenCart” and you get thousands of results, imagine how much money could be stolen by targeting half of these websites and who says its not being done right now? This is why it makes me really angry when web developers don’t take security seriously. Now I love PHP and hate it when people say bad things about the language but its true when they say PHP is like a handgun.
PHP is like a handgun. On its own, it is simply an inanimate tool that has no moral leaning. In the hands of a responsible citizen, it can be used to the benefit of society. But in the hands of someone who is untrained or mentally unstable, it can be used to commit horrible atrocities.
Whenever there’s such a tragedy, other developers are quick to blame PHP. If PHP were illegal, then Yahoo! would never have happened. If we regulated PHP tightly, then there would be no Digg.
via The Register.
Now does anyone have any suggestions on what could be done to get the developer to acknowledge the problem and not just put his head in the sand?
