4

There's any way to bypass a referrer CSRF protection and force www.attacker.com to send a POST request to www.victim.com with the header showing as "referer: https://www.victim.com/"?

For example the script below can change the referrer from the browser page but can an attacker send a request showing a different referrer domain to www.victim.com.

    <script>
          delete window.document.referrer;
            window.document.__defineGetter__('referrer', function () {
                return "https://www.victim.com";
            }); 
alert(document.referrer)
    </script>

https://jsfiddle.net/x3a7k1m0/

I know there are ways to bypass some referrer CSRF protections For example showing the referrer requests with empty or blank but what if the web application rejects empty or blank referrers and a "specific domain or subdomain" is need it in order to process the POST request.

It would be possible to bypass this protection from an external domain?

2
  • yeah, just use curl instead of browser JS...
    – dandavis
    Commented Jun 3, 2016 at 0:31
  • 4
    If there was a way to bypass this it would be considered a major browser vulnerability and be immediately fixed. Commented Jun 3, 2016 at 1:05

2 Answers 2

5

please refer to the "Standard header checks" section on this page :

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

In my knowledge, referrer headers cannot be changed if there is no xss flaw. Ajax requests are also not allowed to change the referrer header as told by someone in comments on this thread:

exploiting CSRF in ajax request via XSS flaw

4
  • 1
    try to bypass the domain check .If the site checks for www.google.com, try www.google.com.yoursite.com
    – entropy
    Commented Jun 3, 2016 at 3:34
  • Thanks entropy. I did try that :) Well I guess referrer CSRF protection is stronger than thought.
    – pancho
    Commented Jun 3, 2016 at 6:02
  • welcome :) could you please make my answer as "helpful" ?
    – entropy
    Commented Jun 3, 2016 at 15:18
  • Even with XSS flaw, you cannot change the Referer: it's part of the "forbidden headers" that cannot be programmaticaly changed developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name
    – Xenos
    Commented Jul 22, 2019 at 15:17
6

Referer is considered a special header (like `Host´) and can not be set inside the browser. So the most you can do with some tricks is to make it empty, but not to point to some other site.

Of course you could use some other tools to make crafted requests with your own Referer header. But in this case you (as attacker) don't have access to the cookies relevant for the target site so it would not work as an CSRF attack either.

4
  • hi. As you mention "you could use some other tools to make crafted requests with your own Referer header", which tools do you mean? i don't need the cookies to be present in the request, how can i force the referer in the CSRF? It is possible without intercepting the request? Commented May 17, 2020 at 4:52
  • @Mr.ToxicMan: curl -H 'Referer: ...' http://... and similar would do this. Commented May 17, 2020 at 5:07
  • Oh i see yea. But it is possible via browser (i don't think so since it is a protected header)?. I found XSS via POST request, so i don't necessary need cookies in the request. Also would it be possible via a link or something similar to trigger a POST request without html or js injected? Commented May 17, 2020 at 5:19
  • @Mr.ToxicMan: "But it is possible via browser ..." - as I already said in my answer: "... can not be set inside the browser. So the most you can do with some tricks is to make it empty, but not to point to some other site.". Commented May 17, 2020 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .