0

Problem behind the question :

We were a small firm developing a small web application
which was similar to fb,gmail,etc [in terms of functionality].
We have a signup form and I was assigned to test the application for vulnerabilities.

Now I did a CSRF over signup form and created a sample which throws a message as :

{"query":{"count":1,"created":"2015-11-12T07:21:59Z","lang":"en-US","results":{"result":"0 ywamob, 1 geo. 1 geo, 0 ywa."}}}

I checked the db and the query was executed through my csrf. ​ Now I asked the developer
to fix this but the developer denied and said it doesn't have any security implications.

My explanation :

I claimed that since I was able to execute the query successfully at your database
without any parameters, the attacker can dump your database through a simple csrf form.

My questions :

Does the dumping of data, executing query a csrf form won't be considered as vulnerability?
If yes any layman explanation to clarify that developer its vulnerablity?

Was my opinion on this one right? ​ If no kindly provide valuable suggestions towards it.

  • imho I feel like you are missing something in this question. Could you please explain what you mean with "I checked the db and the query was executed through my csrf," Are you trying to say that , you did a CSRF attack for a signup form and it added a user? – Xander Nov 13 '15 at 7:58
  • @Xander yes friend,user was not added to db but there were logs for succesful executed query – BlueBerry - Vignesh4303 Nov 13 '15 at 8:06
  • So if it didnt add a user then how the query or your attack is successful? as far as I know, for a successful CSRF, it should make the functionality work! So, for a successful CSRF, in your case, a new user should be signed up. One thing I could tell you is, you can ask the dev to disable that message! Asking him to control message in Server side and send only what the user should know. ! – Xander Nov 13 '15 at 8:11
  • @Xander nice idea xander i will update question with csrf code soon – BlueBerry - Vignesh4303 Nov 13 '15 at 9:43
2

... the attacker can dump your database through a simple csrf form,

A CSRF request alone will only cause the execution of some server side code in the context of a logged in user. The attacker itself is not able to access the results of this request, i.e. is cannot read the response. To get access to the server response you need attacks like Cross-Site-Scripting.

What you often can do with CSRF is to create a new user and then the attacker could log in as this user and access the database directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.