Affiliates Adding Links to your Account

David Naffziger Nov 6, 2009

We recently discovered a Cross Site Request Forgery (CSRF) vulnerability in that is being used by affiliates to insert affiliate links into accounts.

A quick primer on CSRF attacks (from wikipedia):

The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have authenticated.[1] For example, one user, Bob, might be browsing a chat forum where another user, Mallory, has posted a message. Suppose that Mallory has crafted an HTML image element that references a script on Bob's bank's website (rather than an image file), e.g.,


With, attackers are inserting links of their choice into logged in user's accounts. These links appear at the top of the Links History. They are taking advantage of the long cookie expiration for logged in users (2 years I think), and the fact that has no protection mechanisms in place for CSRF attacks.

To see a demo of the CSRF attack, do these things:

  1. Log into your account (you are probably already logged in).
  2. Visit this page (just adds a shortened link to BrandVerity's home page to your account)
  3. Go back to your account and see the new link.

The specific example we found involved an affiliate that was placing affiliate links into accounts. While the links were unlikely to generate a purchase, they were unusual enough that a user would likely click on them to see where they went. This action would drop an affiliate cookie and any purchases made from the merchant by the user would credit the affiliate for the sale.

Here is an example of a CSRF attacked account:, a simple url shortener_1257491307699

We haven't examined the other url shortening services for this vulnerability, but it would be likely that many of them are similarly vulnerable.

Topics: Affiliate Marketing

Don't Miss Out
