-14

I discovered a security vulnerability on Stack Overflow. Currently, the server doesn’t check what URL the “ask a question” form is sent from. That means third-party websites are able to “secretly” send form data to http://stackoverflow.com/questions/ask/submit, and the question will get posted as long as you’re logged in.

This question was actually asked that way. I copied the Stack Overflow “ask a question” form HTML and inserted it into a random webpage via the browser’s developer tools. The question was successfully posted after I filled in and submitted the form.

Stack Overflow should check what URL the “ask a question” form is sent from.

I don’t think checking the referrer URL would be too hard to implement. That’ll prevent fraudulent third-party websites from sending form data to http://stackoverflow.com/questions/ask/submit. These websites might be rare, and there might not be any known ones right now, but think of it this way: even if you’ve never been hacked, it’s still a good idea to use a strong password.

10
  • 1
    I'm no expert, but I don't see the vulnerability in letting people "secretly" post questions however they want. Aug 13, 2016 at 19:45
  • @BilltheLizard It's not the ability to "secretly" post questions however people want. It's that third-party websites can send the form, and a question will be posted without you knowing it.
    – clickbait
    Aug 13, 2016 at 19:49
  • 2
    You may want to mention in the post that 3rd-party sites can post questions as you, if that's what you're saying. Aug 13, 2016 at 19:51
  • 7
    The randomized fkey parameter included in the form should prevent CSRF attempts like this. (If it doesn't, then I agree that this is a problem that needs to be fixed.)
    – Jeremy
    Aug 13, 2016 at 19:53
  • 6
    Checking the referrer would break the site for anyone who has their browser set to not ever send the Referrer header. It's an unreliable field anyways, and should never be trusted.
    – animuson StaffMod
    Aug 13, 2016 at 20:13
  • 8
    I appreciate that you've become more interested in SO, but could you try doing something productive? These down voted meta posts from you are getting tiring.
    – davidism
    Aug 14, 2016 at 0:06
  • 2
    I'm with davidism on this one. At first your interest was nice. But now, you post half researched stuff..... Please calm down and ask less stuff, or at least research it better
    – Patrice
    Aug 14, 2016 at 11:52
  • 2
    @Patrice: "At first your interest was nice." Perhaps you should look at his profile. Apparently, he was responsible for writing auto-downvote scripts. His avatar is even pressing a downvote button. I'm not sure if he was ever a productive member of the community. Aug 14, 2016 at 19:08
  • 1
    "and the question will get posted as long as you’re logged in" so what part of that is “secretly” sending data? we know who posted it
    – Memor-X
    Aug 14, 2016 at 23:19
  • 1
    @NicolBolas didn't you look at his profile? didn't you see all that striked out text and the Bold Capitalized Quote that's yelling that those scripts are discontinued lol
    – Memor-X
    Aug 14, 2016 at 23:22

1 Answer 1

13

These requests are protected by a CSRF token named fkey. Try it, modify it and you will see:

Suspicious request

Sorry, your request could not be completed because it looked suspicious. If you meant to perform an action on Meta Stack Overflow, please return to the previous page and try again.

For a random website to post questions as you, they will need to guess this secret token.

This is a much better way to do this than checking the Referer header, which isn't suitable for this purpose anyway, and even if it would be, relying on it might not be the best idea as many people switch this off since it's both a security and privacy concern (e.g. aside from tracking concerns, it may also reveal private documents such as ?viewkey=secret_viewkey or other "secret" information such as ?session=secret_session).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .