A bug bounty researcher demonstrates an account takeover vulnerability combining stored XSS, information disclosure (API key leakage via group chat endpoints), and JSON-based CSRF using XMLHttpRequest to escalate from low-privilege user to admin account takeover. The attack exploited lack of CSRF protection on API endpoints that relied solely on API key validation.
Ubiquiti UniFi v3.2.10 and below contains a generic CSRF protection bypass that strips the Referer header, allowing attackers to perform unauthorized actions like changing user passwords, adding new users, and creating WLAN configurations. The exploit uses enctype='text/plain', iframe source manipulation, and JavaScript to strip the Referer header and submit JSON-based CSRF attacks.