3

I want to use the CSRFGuard Project to protect a legacy Java webapp against CSRF attacks. The latest published Maven dependency version is 3.1.0, which is what I use.

This is part of the JavaScript code that is included on every protected page:

var xhr = window.XMLHttpRequest ? new window.XMLHttpRequest : new window.ActiveXObject("Microsoft.XMLHTTP");
var csrfToken = {};
xhr.open("POST", "/JavaScriptServlet/", false);
xhr.setRequestHeader("FETCH-CSRF-TOKEN", "1");
xhr.send(null);

var token_pair = xhr.responseText;
token_pair = token_pair.split(":");
var token_name = token_pair[0];
var token_value = token_pair[1];

It is a separate JS file generated by a dedicated servlet, with no-cache headers.

I do not understand why the token name and value are not directly embedded into the generated JavaScript, but instead fetched via a synchronous (!) AJAX call.

Are there any vulnerabilities if I change it to include the token directly?

2

Are there any vulnerabilities if I change it to include the token directly?

Oh yeah.

Then an attacker could just include that script on their page:

<script src="http://yourserver.tld/yourpart"></script>

And let it run this code:

var token_name = "sample-token-name";
var token_value = "sample-token-value";

Then both token_name and token_value will not be global variables on the attacker's page that can be accessed and used to create the CSRF attack.

The reason they are using AJAX to get the token is that this request would fail if the attacker just includes the script tag because of same-origin policy.

As for why they are using synchronous AJAX, I doubt there is a reason except poor design.

  • I should have included a link to the full template of the js source: github.com/aramrami/OWASP-CSRFGuard/blob/master/csrfguard/src/… I think the check against "document.domain" should protect against this? – Michael Böckling Dec 8 '16 at 21:58
  • @MichaelBöckling document.domain can be spoofed. Object.defineProperty(document, 'domain', {get:function(){return 'lol.wat';}}); console.log(document.domain); – Alexander O'Mara Dec 8 '16 at 22:03
  • Wow, I just assumed this was a protected property. Thanks! Do you happen to know of a well implemented javascript client that supports automatic CSRF token injection into forms and ajax headers? I'm not sure I trust that OWASP implementation anymore. – Michael Böckling Dec 9 '16 at 15:09
  • @MichaelBöckling Sorry, I'm afraid I don't, I've never had to try to tack CSRF into a legacy system. – Alexander O'Mara Dec 9 '16 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.