I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS vulnerability, then CSRF is not your biggest concern. But what happens if the other site as a XSS vulnerability?
Let me set the stage.
- fakebank.com = your bank which has a funds transfer page that requires you to use a unique token you get on a get page that must be included in a post. You are currently logged into it.
- insecurefun.com = a site you are currently visiting. Has numerous issues, including XSS vulnerability.
- malicioussite.com = a nasty site that you never want to visit, but it happens to have put up a few adds on insecurefun.com.
Now, I'm pretty sure this can't work, because if the Synchronizer Token Pattern could be so easily exploited, it wouldn't be recommended as protection against CSRF attacks. But, what I don't get is why this cannot be exploited.
My only guess is that the malicious script cannot get a hold of the unique token to use it due to same domain policy. But if you do something like this, it seems the malicious script could launch the GET have have the HTML returned as a string, parse the data for the unique token, and then launch the POST without the user being informed. What am I missing that would prevent this from working?