2

There's any way to bypass a referrer CSRF protection and force www.attacker.com to send a POST request to www.victim.com with the header showing as "referer: https://www.victim.com/"?

For example the script below can change the referrer from the browser page but can an attacker send a request showing a different referrer domain to www.victim.com.

    <script>
          delete window.document.referrer;
            window.document.__defineGetter__('referrer', function () {
                return "https://www.victim.com";
            }); 
alert(document.referrer)
    </script>

https://jsfiddle.net/x3a7k1m0/

I know there are ways to bypass some referrer CSRF protections For example showing the referrer requests with empty or blank but what if the web application rejects empty or blank referrers and a "specific domain or subdomain" is need it in order to process the POST request.

It would be possible to bypass this protection from an external domain?

  • yeah, just use curl instead of browser JS... – dandavis Jun 3 '16 at 0:31
  • 3
    If there was a way to bypass this it would be considered a major browser vulnerability and be immediately fixed. – Ammar Bandukwala Jun 3 '16 at 1:05
3

please refer to the "Standard header checks" section on this page :

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

In my knowledge, referrer headers cannot be changed if there is no xss flaw. Ajax requests are also not allowed to change the referrer header as told by someone in comments on this thread:

exploiting CSRF in ajax request via XSS flaw

  • 1
    try to bypass the domain check .If the site checks for www.google.com, try www.google.com.yoursite.com – entropy Jun 3 '16 at 3:34
  • Thanks entropy. I did try that :) Well I guess referrer CSRF protection is stronger than thought. – pancho Jun 3 '16 at 6:02
  • welcome :) could you please make my answer as "helpful" ? – entropy Jun 3 '16 at 15:18
  • Even with XSS flaw, you cannot change the Referer: it's part of the "forbidden headers" that cannot be programmaticaly changed developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name – Xenos Jul 22 at 15:17
4

Referer is considered a special header (like `Host´) and can not be set inside the browser. So the most you can do with some tricks is to make it empty, but not to point to some other side.

Of course you could use some other tools to make crafted requests with your own Referer header. But in this case you (as attacker) don't have access to the cookies relevant for the target site so it would not work as an CSRF attack either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.