{"action":"opened","issue":{"url":"https://api.github.com/repos/piwik/piwik/issues/8908","labels_url":"https://api.github.com/repos/piwik/piwik/issues/8908/labels{/name}","comments_url":"https://api.github.com/repos/piwik/piwik/issues/8908/comments","events_url":"https://api.github.com/repos/piwik/piwik/issues/8908/events","html_url":"https://github.com/piwik/piwik/issues/8908","id":109680545,"number":8908,"title":"Insufficient Authentication in PIWIK‏","user":{"login":"tusharparab","id":14963847,"avatar_url":"https://avatars.githubusercontent.com/u/14963847?v=3","gravatar_id":"","url":"https://api.github.com/users/tusharparab","html_url":"https://github.com/tusharparab","followers_url":"https://api.github.com/users/tusharparab/followers","following_url":"https://api.github.com/users/tusharparab/following{/other_user}","gists_url":"https://api.github.com/users/tusharparab/gists{/gist_id}","starred_url":"https://api.github.com/users/tusharparab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tusharparab/subscriptions","organizations_url":"https://api.github.com/users/tusharparab/orgs","repos_url":"https://api.github.com/users/tusharparab/repos","events_url":"https://api.github.com/users/tusharparab/events{/privacy}","received_events_url":"https://api.github.com/users/tusharparab/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-04T13:10:00Z","updated_at":"2015-10-04T13:10:00Z","closed_at":null,"body":"Hi Team,\r\n\r\nI have locally hosted PIWIK (2.14.3) on my machine and tested few modules of it. While going through an account I have observed that when user gets created, he/she gets on \"token_auth\" which is static for Life Time. (It doesn't expire after logout).\r\n\r\nIf in any way I get this token of account owner, I will have life time access of his/her account. I can fire any any request on owner's account whether its of creating user, deleting user, creating Email report or delete Email reports etc.\r\n\r\nNote that, this vulnerability is present/tested on latest version of PIWIK and also on your \"Cloud-hosted Piwik\".\r\n\r\nPOC:\r\n1. Login to account.\r\n2. Create a user or create Email report and Capture that POST request.\r\n3. Logout from account.\r\n4. Modify and Replay request captured in step 2 and see success response.\r\n5. Login into account and verify changes.\r\n\r\nIn fact, in step 4, you don't need a cookie to get success response. :D :D .  You can fire that request without any valid/invalid cookie.\r\n\r\nYou only need user's \"token_auth\" and account name of account owner. And all you can own his account.\r\n\r\nRecommendation:\r\nInstead of using t\r\n\r\noken_auth, you should use Anti-CSRF token to verify each and every incoming request from users.\r\nIf you implement Anti-CSRF token in proper way, all such malicious requests will fail.\r\n\r\nI have uploaded video POC and Sample requests on dropbox. In this Video-POC, I have created and deleted \"Email Reports\" after logout. In such a way, you can create users or delete user or can do any operations.\r\n\r\nDownload Link:\r\nhttps://www.dropbox.com/s/f3jbb6k3z2ku374/Create%20and%20Delete%20Email%20Report%20-%20PIWIK.zip?dl=1\r\n\r\nRequest you to please check the same and let me know if anything is needed.\r\n\r\n\r\nThanks,\r\nTushar\r\n"}}