Edit: biggest giveaway besides the add user page asking for a session and csrf token is the "failing accounts" and fail logs, which the spammer likely uses to figure out which accounts have been banned from posting or throttled.
* The admin looks way too trivial for a site of that magnitude
* Pinterest is built with Django which comes with a secure auth framework included that stores passwords hashed and salted
* Why would Pinterest refer to their own users as "Pinterest users"?
Looks more like a Pinterest spam bot to me.
Also, the fact that the form in your screenshot ask for csrf token and session id is very odd.
I'd argue that you found something that wasn't built by Pintest but instead someone's tool for controlling and managing multiple Pinterest accounts.
Adding a change password function to a custom model is too trivial
class MyUser(models.Model):
password = models.CharField(max_length=128)
set_password = django.contrib.auth.models.User.set_password.__func__
check_password = django.contrib.auth.models.User.check_password.__func__
CSRF token and sessionid is probably needed to create an account directly because by default django has CSRF protection built in and maybe in order to hit the create account page you need to manually grab it.
As I mention there, there was still a minute possibility that even if this didn't belong to Pinterest, it could have been an internal tool for a small team or an employee hack day/side project that got accidentally exposed.
The easiest one is cross site scripting sourced from a recently de-comissioned elastic IP. Its easy, really easy in fact. So much so that its been done more than once (duh).
Its been used for phishing, except the IP wasn't hijacked or misused, it was just reused by someone who was attentive enough to wonder what all that HTTP traffic was about.
Its been used for "shocksiting", where all of a sudden, your favorite AWS hosted website redirects to one of the more famous shocksites, serves an ad and makes them money. I won't share any of the links here, they're easy to find.
This current pinterest problem is pretty bad, I just checked the date on my machine and its 2013 so nobody with any sense should be storing unencrypted passwords. Even ROT13 would be better than nothing...
Q: Why does Pinterest store passwords in plaintext?
A: Tracy Chou, software engineer at Pinterest - "We don't."