0

So say I've stored Facebook cookies, so that I don't have to login every time I visit Facebook. Would a CSRF attack on Facebook work(assuming they don't have CSRF protection), if I don't currently have a browser tab open logged into Facebook?

  • The key here is that any website can make you "visit" Facebook by issuing a cross-origin request that exploits a CSRF vulnerability in the background. (E.g. by loading Facebook in a hidden frame, as an image, via AJAX, etc.) – Arminius Aug 1 '17 at 2:27
  • Generally speaking having a session cookie stored is a requirement for CSRF. – Xiong Chiamiov Aug 2 '17 at 15:27
3

Though there are some details that impact this, going by the general principles, the answer is YES.

An attack exploiting CSRF would attempt to execute some function of the target site (facebook, in your example) in the browser context.

So the key test is: If you open facebook in a tab (in the scenario you mentioned), would it give you a logged-in session directly. It appears that it would. In that case, it meets the conditions necessary to mount a CSRF attack.

There are many nuances. For example: Vulnerability != Exploit. i.e., though the attacker may get CSRF to work (and produce a POC to get a bug bounty or complete a VA/PT assignment) - there may be nothing there to exploit due to other protections. e.g., if additional auth is required to really do any damage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.