catrobat / catroweb Goto Github PK

Catroweb - A social platform to share and browse projects created with Catrobat's apps (Pocket Code, ...) by our users.

License: GNU Affero General Public License v3.0

PHP 49.99% CSS 4.40% JavaScript 6.40% Gherkin 30.05% Dockerfile 0.07% Shell 0.32% SCSS 1.96% Twig 6.78% Handlebars 0.02%

docker-compose hacktoberfest js mariadb php symfony

catroweb's Introduction

⚠️ **If you have not heard about who Catrobat is, what we are doing and in what ways you can contribute, then you might want to take a step back and check out the start of our step-by-step guide.**

👷 TODO: Change link to README in Catrobat's .github repository when added!

💡 If any step in the following process is unclear, misleading, or incorrect, you can directly contribute by issuing a pull request with the updated information!

Catroweb

Catroweb is the name of the "Pocket Code" sharing platform, where our community can upload their projects. If you uploaded your game in the previous step, it should already be visible to all other users. They can now download and remix your masterpiece. Additionally, the platform provides users with features typical for a social network.

Team Culture

We work as a team and expect everyone to follow the rules. In our daily work, we use the methods listed below to create high-quality code. We support each other but also anticipate newcomers to learn about our coding principles proactively:

Test-Driven Development
Clean Code
Jira Workflow
Style Guide
Code Reviews
Pair Programming
Biweekly Meetings (remote)

Technologies

Below you can find an outline of the technologies we currently use at Catroweb. If you want to contribute to our team, your tech stack should cover most of the technologies. But don't worry! If you are uncertain about a specific technology, you can learn it along the way. Google is your friend ;)

Languages

Infrastructure (IDE, Version Control, Issue Tracking, ...)

Knowledge Repository

Communication

Start Contribution

If you feel confident that your tech stack matches our requirements, then we invite you to start contributing!

Issues

You found a bug?

Perfect, please check the open issues on Jira first to avoid duplicate tickets!
If the bug has not been reported yet, please report it using the issue template on Jira.

catroweb's People

Contributors

Stargazers

Watchers

Forkers

markoburazer sjaindl rachel-walker rsamer robertpainsi chartinger fleetadmiral guptasurbhi96 thomaskoinig ckissane kobi14 hcrane mfuerni wardplaced regnisier ognjenantonictu sasadermanovic leno12 wolfianer thomasschwengler felixauf arminpasalic10 m-herold isolatedsys plantinumx jackshahhoud hebesempso annalickl abdelaty auraofdivinity sudhanshusahil samrat2825 11possim ratschillerp dmetzner2 tamdav mahmoudzkhalil marweb1996 danielzhang130 hallogitty hungryapeman chrisi122 youngshingjun yash-punia burimvrella deajasini krennkristof boidl ermalgashi1 kropiunig dermaku-dardan dmetzner schaubes lizhengdao debidattasuryaprakash yugalkishore59 mseiser schrpa rohityandigeri bprattes mohit-aasirwal bartarik sebastiangollob eifonuser bonbuo samrj12 rajeck1234 makne17 makre10 greilberger13 abdul-ahad-c aaravm aditya6021 simon-costisella ludmat sudeegaria g-jordan sarahjanenft edmondnrecaj

catroweb's Issues

add hover-effect on the links in the footer

There should be a hover effect on the links provided in the footer. It could be a color change similar to the sidebar links.

Critical security issue: 1-click Account Takeover due to missing CSRF Token

Hello,
I am opening a new issue here about a critical vulnerability I found since "Security" tab in your Github repo is not setup for bug submissions.

Bug: Missing CSRF Token leads to 1-click Account Takeover
Description: An attacker can successfully takeover accounts (mass takeover is possible too), by only forcing a user to visit a website (so only 1 interaction is required by the user). After visiting the website, 4 POST requests will be automatically sent by user to the webapp to change his/her data such as: username, email address, password, profile picture without his/her knowledge.

Please find attached the HTML file as a PoC for this demo. Once a user opens this HTML file (hosted as a website or a file, doesn't matter), the account will be changed with the following data:

Username: hacked
Password: hacked
Email: [email protected]
Profile picture as demonstrated in the attached video.

I also would like to mention another vulnerability which lead to this critical one.
When a user wants to change the password, he basically sends the following POST Request:

POST /app/passwordSave HTTP/2
Host: share.catrob.at
Cookie: cookie_values_here
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 83
Origin: https://share.catrob.at
Referer: https://share.catrob.at/app/user

oldPassword=mystrongpassword&newPassword=mynewpassword&repeatPassword=mynewpassword

There are clearly 3 POST parameters (oldPassword, newPassword and repeatPassword). The problem relies on oldPassword parameter which is not being checked if it is missing or not. So basically you can remove that parameter and you can setup a new password without knowing your old one.

POST /app/passwordSave HTTP/2
Host: share.catrob.at
Cookie: cookie_values_here
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 83
Origin: https://share.catrob.at
Referer: https://share.catrob.at/app/user

newPassword=mynewpassword&repeatPassword=mynewpassword

This bug was also implemented in the HTML PoC, leading to this 1-click Account Takeover vulnerability.

Mitigation
I strongly advise to implement Anti-CSRF Token when a user is changing the mentioned data.
Make sure that oldPassword is present in the HTTP Request when changing the password.

Video PoC:
https://user-images.githubusercontent.com/37262788/168836544-be1e4737-a872-45df-b4ad-8828a25ec2e5.mp4

HTML PoC (Please change the extension to .html, since Github doesn't allow uploading HTML files)
catrobat_csrf_html_file.txt

Please let me know if more information is needed,
Kind regards!
.

Enhancement for catroweb

This enhancement include of keeping a home button in the menu bar and in footer menu bar