Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

Edit

Assume the web server has CSRF vulnerability. No hidden token checking will be done on the server.

share|improve this question

2 Answers

up vote 3 down vote accepted

No. CSRF works by using a session already in place, and sessions can only exist within the same browser. Or put another way, all current/major browsers do not share sessions.

EDIT: As noted in the comment, it is theoretically possible using flash cookies. IMO, flash cookies are evil to begin with though.

share|improve this answer
4  
While this is generally true, there are theoretical (and possibly practical) possibilities to conduct current attack via LSO, or so-called flash-cookies. Sure, this heavily depends on application specifics and implementation. – anonymous Mar 5 '11 at 19:28
1  
Good point, @ams. I wonder if this also might apply to Silverlight Isolated Storage, the various HTML5 storage options, web-keys/URL capabilities or any of the other persistence methods used by evercookies. – nealmcb Mar 5 '11 at 20:03
Good point. I didn't take into account plugins. – SteveS Mar 5 '11 at 22:06
up vote 2 down vote

Assuming that the existing CSRF vulnerability is based on the presence of a login cookie, then the simple answer is no (in the general case).
Different browsers (e.g. IE/FF/GC/Safari) each manage their own cookies, and logging in on one will have no effect whatsoever on the cookies for another browser.

However, there are other CSRF flaws which are no based on cookies, which may be relevant to other browsers.
For example, Integrated Windows Authentication -based CSRF would be relevant for IE, even if you had logged in on say FF. Or any other non-cookie based authentication/session management, including flash-based sessions, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.