I discovered a security vulnerability on Stack Overflow. Currently, the server doesn’t check what URL the “ask a question” form is sent from. That means third-party websites are able to “secretly” send form data to http://stackoverflow.com/questions/ask/submit
, and the question will get posted as long as you’re logged in.
This question was actually asked that way. I copied the Stack Overflow “ask a question” form HTML and inserted it into a random webpage via the browser’s developer tools. The question was successfully posted after I filled in and submitted the form.
Stack Overflow should check what URL the “ask a question” form is sent from.
I don’t think checking the referrer URL would be too hard to implement. That’ll prevent fraudulent third-party websites from sending form data to http://stackoverflow.com/questions/ask/submit
. These websites might be rare, and there might not be any known ones right now, but think of it this way: even if you’ve never been hacked, it’s still a good idea to use a strong password.
fkey
parameter included in the form should prevent CSRF attempts like this. (If it doesn't, then I agree that this is a problem that needs to be fixed.)