search

matomo-org / matomo

Empowering People Ethically with the leading open source alternative to Google Analytics that gives you full control over your data. Matomo lets you easily collect data from websites & apps and visualise this data and extract insights. Privacy is built-in. Liberating Web Analytics. Star us on Github? +1. And we love Pull Requests!
https://matomo.org/
GNU General Public License v3.0
19.92k stars 2.66k forks source link

Homograph attack #13920

Closed orthon closed 1 month ago

orthon commented 5 years ago

Hello Kraken, I have found another interesting bug in the API key's list.

Bug: Homograph attack.

Description: Please refer https://en.wikipedia.org/wiki/Internationalized_domain_name to know more about IDNs. The IDN (Internationalized Domain Name) : http://ebаy.com/ is a homograph for the latin ebay.com . if you click that first link, you might think that you are going to ebay.com but in fact, you are going to a homograph url http://xn--eby-7cd.com/

When such an IDN is present on profile (for ex if your follower is having access to see your profile). ,it displays IDN in Unicode. It would be safer to represent the Punycode version of the URL so that it would be apparent to the users that something wierd is going on. i.e show http://xn--eby-7cd.com/ instead of http://ebаy.com/

steps:

  1. ogin

  2. go to all websites

  3. click on add new website and new measurable website.

  4. add : http://xn--eby-7cd.com/ in the URL's

  5. as a hyperlink it is shown as : http://xn--eby-7cd.com/ but it will actually take you to http://xn--eby-7cd.com/

Thanks!

Note: Since hackerone already fixed this issue, you will bot say ebay site in this report, because it is filtering the unicode characters. you can follow up with the screenshot attached or you can ask me for more information.

Thanks!

Impact A bad guy can exploit this vulnerability by putting up a spoof site behind one of these IDN links, posting the link anywhere on Pinterest (The talk section can be a nice place) and the user or the kraken moderator/admin opens and carelessly enters his credentials there.

sgiehl commented 1 month ago

I'm not able to reproduce that. Maybe browsers meanwhile changed how they display such homograph urls. If I add http://xn--eby-7cd.com/ as an url. It is exactly displayed that way within Matomo. Can't seen any place where it appears a http://ebay.com