1

I am testing an application, and come across a GET request that returns sensitive info in the response body. (CSRF token to be validated for next request). Since it is a GET request, developer skipped CSRF protection for all the GET requests and only applied to POST or state changing requests. That token will be used for next POST request.

I know using XHR we can accomplish this, but IF CORS is not enabled, or allowed only for particular domain, is it still possible to perform CSRF in such case without XHR?

Improve this question
2
  • 1
    Preventing coss-domain reading without explicit permission is the main idea of the SOP. So there is obviously no simple workaround to access the response body.
    – Arminius
    Aug 3, 2017 at 8:49
  • Yes, that is what SOP is meant for, but was just confirming if there is any way to bypass available.
    – PenGeek
    Aug 3, 2017 at 8:58

1 Answer 1

Reset to default
1

Depending on what the response looks like, you might in some rare cases be able to use a XSSI attack (Cross Site Script Include). That means, if the response represents a valid JavaScript statement (that includes the sensitive info), you could simply create a page that imports that script and than read it in some way with a different script. That works because the SoP does not prevent you to create a script tag and import a script from a different domain. An example attack can be found here:

http://blog.intothesymmetry.com/2017/05/cross-origin-brute-forcing-of-saml-and.html

Improve this answer
2
  • Thanks this is really helpful. I believe this will work only in case of content-type is application/javascript Correct me if i am wrong.
    – PenGeek
    Aug 11, 2017 at 6:20
  • No, the content type does not have to be application/javascript. In the example under the link I attached, the content type was text/plain.
    – pineappleman
    Aug 11, 2017 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .