# UniFi v3.2.10 Cross-Site Request Forgeries / Referer-Check Bypass

UniFi v3.2.10 CSRF protection only checks Referer presence/match; stripping the Referer header via iframe bypasses it, letting an attacker change the admin password.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: mrtuxracer
- Disclosed: 2016-01-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/52635
- Library page: https://bugbountylibrary.com/r/h1%3A52635
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:java technique:source-review vuln:auth-bypass vuln:csrf

**Target:** UniFi administrative web interface (api/s/default/cmd/sitemgr)
**Root cause:** CSRF defense only validates that the Referer header is present and matches the host; a request with no Referer header is treated as trusted rather than rejected.
**Steps:**
1. Observe legitimate password-change POST to `https://127.0.0.1:8443/api/s/default/cmd/sitemgr` with `json=%7B%22name%22%3A%22admin%22%2C%22x_password%22%3A%22test%22...%22cmd%22%3A%22set-self%22%7D` and Referer set to the host.
2. Craft a cross-site form POST with `enctype=text/plain` to the same endpoint; browser sends Referer of attacker site, server returns 401 `api.err.LoginRequired`.
3. Load the form inside an `about:blank` iframe so the browser omits the Referer header entirely.
4. Submit the POST without Referer; server returns 200 `rc: ok` and admin password is changed to `csrfpwd`.
5. Log in with `username=admin&password=csrfpwd&login=Login` to confirm takeover.
**How found:** Noticed the app only checks Referer presence/match; hypothesized that a missing Referer would be treated as valid, and confirmed by stripping the header via an about:blank iframe.
**Exploitation:** Attacker hosts a page that builds a text/plain form targeting the victim's UniFi controller, injects it into an about:blank iframe to suppress the Referer header, and auto-submits it. The victim's authenticated session cookie is sent, the password/email of admin is changed, and the attacker logs in with the new credentials.
**Insight:** When a CSRF defense checks Referer equality, test the absent-Referer case: an about:blank iframe or Referrer-Policy can suppress the header, and many implementations fail open on null.