# Общий CSRF токен для сообщений сообществ, или как подставить соседа-редактора

VK community IM CSRF hash was bound to group_id, not the user, so any editor's hash could force another editor to send messages as them.

- Payout: $300
- Severity: medium
- Program: VK.com
- Credited: povargek
- Disclosed: 2018-07-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/315524
- Library page: https://bugbountylibrary.com/r/h1%3A315524
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:business-logic vuln:csrf

**Target:** Community IM (/al_im.php?gid=XXX) CSRF token
**Root cause:** The CSRF `hash` for group IM actions was derived from `group_id` only, so it was identical for every user with access to that group's inbox instead of being per-user/session-bound.
**Steps:**
1. Obtain the group IM `hash` for a group you have access to (e.g. from /al_im.php?gid=XXX).
2. Craft a CSRF page that submits a message-send request to /al_im.php with the victim's peer_id and the shared `hash`.
3. Lure another editor/admin of the same group (who has IM access) to the page.
4. Message is sent from the victim's account to the chosen peer_id.
5. Later: find a way to obtain a static (non-timehash) `hash` to keep the CSRF usable after losing IM access.
**How found:** Noticed the `hash` parameter was identical across different users for the same group, hypothesizing it was keyed on group_id rather than user; then tested cross-user CSRF and later hunted for a static hash variant.
**Exploitation:** Attacker with any access to a group's IM extracts the group-wide `hash`, builds a CSRF form targeting message-send with an arbitrary peer_id, and tricks a higher-privileged editor into loading it; the message is delivered as that editor. Timehash lifetime ~7h limited the window until a static hash was found.
**Escalation:** Chaining a static hash discovery extended the attack beyond the ~7h timehash window and beyond loss of IM access, enabling persistent CSRF (e.g. revenge after admin removal).
**Insight:** When a CSRF token is scoped to a shared resource (group/team/org) rather than the user, any low-privileged member can harvest it and replay it against higher-privileged members of the same resource; check whether tokens differ between two accounts on the same object.