Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.

There isn't a lot of good information out there and it seems that in .NET, *.asmx are protected by default to CSRF, with a possible exception of an exploit scenario using Flash (to set the cookies)

[updated info]

If you want to take a look at the code, the whole thing is at GitHub, and here is the source code of the version with a test Library (OWASP Top 10): https://github.com/TeamMentor-OWASP/Master (just download the zip file and click on the 'Start webserver.bat' to have a locally running copy)

If you just want to take a look at it, check out this test server: http://50.18.82.146:8081 for the main GUI and http://50.18.82.146:8081/aspx_pages/tm_webservices.asmx for the webservices In terms of CSRF for ASMX, my current understanding comes mainly from this Scott Guthrie article http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx (also referenced here AJAX Hacker Attacks - Cross Site Request Forgery )

Those articles imply that asmx webservices are not vulnerable to CSRF due to the extra application/json ContentType header.

share|improve this question

1 Answer 1

Without providing more detail about your web services, I would say yes there is a very good chance it is. However the exploit is probably not what would expect as it is different from your usual HTTP POST/GET CSRF exploit. In the case of SOAP or other web services the body of the message is XML or some other block of data. When I write PoC CSRF exploits for services like this I am forced to use ActionScript's request.data feature. It also should be noted that many, but not all of the http request headers can be set and modified with ActionScript.

share|improve this answer
    
Hi Rook, I just updated the original question to add details about where you can get the Source Code of the app (in case you want to take a look at it) –  Dinis Cruz Feb 6 '12 at 12:24
    
In terms of the use of ActionScript, that is the only vector that looks like might work, BUT, only if one can set the ContentType to application/json (for example some browsers do allow the manipulation of content type via form submission, BUT only to a set of values (i.e. not to application/json)) –  Dinis Cruz Feb 6 '12 at 12:34
    
@Dinis Cruz i know for a fact ActionScript works well with json and xml APIs. Anyway i am not going to look at any of your code. This isn't free. –  Rook Feb 6 '12 at 16:21
    
Fair enough, I will :) Thx for the help –  Dinis Cruz Feb 6 '12 at 19:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.