While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.

There isn't a lot of good information out there and it seems that in .NET, *.asmx are protected by default to CSRF, with a possible exception of an exploit scenario using Flash (to set the cookies)

[updated info]

If you want to take a look at the code, the whole thing is at GitHub, and here is the source code of the version with a test Library (OWASP Top 10): https://github.com/TeamMentor-OWASP/Master (just download the zip file and click on the 'Start webserver.bat' to have a locally running copy)

If you just want to take a look at it, check out this test server: for the main GUI and for the webservices In terms of CSRF for ASMX, my current understanding comes mainly from this Scott Guthrie article http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx (also referenced here AJAX Hacker Attacks - Cross Site Request Forgery )

Those articles imply that asmx webservices are not vulnerable to CSRF due to the extra application/json ContentType header.


Without providing more detail about your web services, I would say yes there is a very good chance it is. However the exploit is probably not what would expect as it is different from your usual HTTP POST/GET CSRF exploit. In the case of SOAP or other web services the body of the message is XML or some other block of data. When I write PoC CSRF exploits for services like this I am forced to use ActionScript's request.data feature. It also should be noted that many, but not all of the http request headers can be set and modified with ActionScript.

  • Hi Rook, I just updated the original question to add details about where you can get the Source Code of the app (in case you want to take a look at it) – Dinis Cruz Feb 6 '12 at 12:24
  • In terms of the use of ActionScript, that is the only vector that looks like might work, BUT, only if one can set the ContentType to application/json (for example some browsers do allow the manipulation of content type via form submission, BUT only to a set of values (i.e. not to application/json)) – Dinis Cruz Feb 6 '12 at 12:34
  • @Dinis Cruz i know for a fact ActionScript works well with json and xml APIs. Anyway i am not going to look at any of your code. This isn't free. – rook Feb 6 '12 at 16:21
  • Fair enough, I will :) Thx for the help – Dinis Cruz Feb 6 '12 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.