1

I am testing an application, and come across a GET request that returns sensitive info in the response body. (CSRF token to be validated for next request). Since it is a GET request, developer skipped CSRF protection for all the GET requests and only applied to POST or state changing requests. That token will be used for next POST request.

I know using XHR we can accomplish this, but IF CORS is not enabled, or allowed only for particular domain, is it still possible to perform CSRF in such case without XHR?

  • 1
    Preventing coss-domain reading without explicit permission is the main idea of the SOP. So there is obviously no simple workaround to access the response body. – Arminius Aug 3 '17 at 8:49
  • Yes, that is what SOP is meant for, but was just confirming if there is any way to bypass available. – PenGeek Aug 3 '17 at 8:58
1

Depending on what the response looks like, you might in some rare cases be able to use a XSSI attack (Cross Site Script Include). That means, if the response represents a valid JavaScript statement (that includes the sensitive info), you could simply create a page that imports that script and than read it in some way with a different script. That works because the SoP does not prevent you to create a script tag and import a script from a different domain. An example attack can be found here:

http://blog.intothesymmetry.com/2017/05/cross-origin-brute-forcing-of-saml-and.html

  • Thanks this is really helpful. I believe this will work only in case of content-type is application/javascript Correct me if i am wrong. – PenGeek Aug 11 '17 at 6:20
  • No, the content type does not have to be application/javascript. In the example under the link I attached, the content type was text/plain. – stanko Aug 11 '17 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.