Is it possible to perform CSRF attacks on file upload functionality? My application uploads files by sending multipart/form-data POST requests without any random token. Is it possible to prepare a HTML form which will demonstrate this attack on the application?


1 Answer 1


Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded.

So how can this be exploited? If your site is example.com the attacker host some JS like this on a site that she tricks the victim into visiting:

myFormData = new FormData();
myFormData.append("file", fileContent, "filename.txt");
fetch("http://example.com/fileupload.php", {
    method: "post",
    body: myFormData,
    credentials: "include"

This will make the victims browser send a POST request to your site, with whatever the attacker chooses as fileContent as the file.

  • 1
    In practice this does not work because of the same-origin policy. The victim domain would have to have whitelisted the attacker's domain (e.g. by setting * in the CORS header) in order to allow the XMLHttpRequest or Fetch API call across domains.
    – Polynomial
    Commented Feb 17, 2021 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .