What defines a CSRF vulnerability?

Question

As a part of my position at the company I am employed with, I manually penetration test our web application (still in development) for vulnerabilities. While testing, I attempted to see if our web application was vulnerable to CSRF. To do so, I ran the application in tab A and authenticated with the web app. In tab B I opened the JavaScript console and ran:

window.location.replace("http://privilegedLocationInWebApp.com");

The redirect was successful, directing tab B to an authenticated page within the web application.

Later in the day at home, I decided to play around and see what other sites are vulnerable to this as it struck me as something that is probably frequently overlooked and testing it causes no harm to the webpage (i.e. I am not trying to SQL inject them or do any damage). Attempting such a redirect on a non-authenticated tab with a separate tab already authenticated was successful on multiple sites, a few seeming to be a little too important to allow such a vulnerability.

Is this really a CSRF vulnerability? Or is this simply overlooked by owners of websites and web apps since these requests are all GET requests but an attempt to do a POST might be rejected as that would symbolize a true CSRF vulnerability?

Answer 1

There are a number of misunderstandings here:

• Tabs can not be "authenticated" or "unauthenticated". If you are using cookie based sessions for authentication, it is the presence of the session cookie that gives you access. That cookie belongs to the browser session, and not to a specific tab.
• Loading a "priveliged location", i.e. a page that an unauthenticated user should not have access to, is not proof of CSRF.

The victim could itself just open a new tab, enter the URL to the priveliged location, and have access to it, right? All you have done is to do this with a bit of JavaScript. How could you, as an attacker, leverage this? You couldn't! The browsers Single Origin Principle would stop you from reading any data, and you didn't trick the server into performing an action.

So what would consitute proper CSRF? For this to be useful, you have to get the server to do something - create a user, delete a post, change a setting, whatever. As you say, this would normally require a POST request, but on a poorly designed page it might be possible with GET as well. Anyway, that is what you should be looking for!