CSRF LOGOUT IMPACT :
Logout should protect your logout mechanism against CSRF. At first it seems that all an attacker can do is logout the user, which would be annoying at worst. However, if you combine this with a phishing attack, the attacker may be able to entice the victim to re-login in using their own form and then capture the credentials. Very sketchy, but to protect against this sort of attack requires little cost.
LOGOUT CSRF POC :
Overview:
Hello , This is Abdul Haq Khokhar , I am Independent Security Researcher and I have recently found Vulnerability in website (Private Program) on hackerone.com and I don't want to disclose website because my report is still Triaged (12-12-2014) and security team is fixing now.well vulnerability was really simple as i shown in below POC-Screenshot and i was just testing this vulnerability first time so i tried on this web and Got the Shocking response from the Website .
BUG : Logout CSRF Cross site Request Forgery CSRF
POC Code :
Already shown in POC Screenshot above .
Reporter : Abdul Haq Khokhar
After Reading the Response from Security team :
Reward : 250$
I hope you enjoyed this article and Hopefully you guys will try this bug on other websites too :-D
“Let him who would enjoy a good future waste none of his present.”
Roger Babson
