2

As a part of my position at the company I am employed with, I manually penetration test our web application (still in development) for vulnerabilities. While testing, I attempted to see if our web application was vulnerable to CSRF. To do so, I ran the application in tab A and authenticated with the web app. In tab B I opened the JavaScript console and ran:

window.location.replace("http://privilegedLocationInWebApp.com");

The redirect was successful, directing tab B to an authenticated page within the web application.

Later in the day at home, I decided to play around and see what other sites are vulnerable to this as it struck me as something that is probably frequently overlooked and testing it causes no harm to the webpage (i.e. I am not trying to SQL inject them or do any damage). Attempting such a redirect on a non-authenticated tab with a separate tab already authenticated was successful on multiple sites, a few seeming to be a little too important to allow such a vulnerability.

Is this really a CSRF vulnerability? Or is this simply overlooked by owners of websites and web apps since these requests are all GET requests but an attempt to do a POST might be rejected as that would symbolize a true CSRF vulnerability?

  • 1
    Opening a new tab in the same web browser is not an effective way to test for CSRF. At the very least you should be using another browser. – DKNUCKLES Jan 15 '18 at 14:30
  • Isn't the idea that if you are authenticated on one tab, an attacker can send you a purposely crafted link in say your email on a separate tab so when you click it, the request is accepted due to your authentication on the first tab? I understand a separate browser would be a greater issue but authentication should not work across tabs in such a way from my understanding. – dFrancisco Jan 15 '18 at 14:33
  • It's only a problem if you can change anything. If you can craft a link that changes some data on the server it is a problem. Just showing the page to the user is no problem. – Josef Jan 15 '18 at 14:41
8

There are a number of misunderstandings here:

  • Tabs can not be "authenticated" or "unauthenticated". If you are using cookie based sessions for authentication, it is the presence of the session cookie that gives you access. That cookie belongs to the browser session, and not to a specific tab.
  • Loading a "priveliged location", i.e. a page that an unauthenticated user should not have access to, is not proof of CSRF.

The victim could itself just open a new tab, enter the URL to the priveliged location, and have access to it, right? All you have done is to do this with a bit of JavaScript. How could you, as an attacker, leverage this? You couldn't! The browsers Single Origin Principle would stop you from reading any data, and you didn't trick the server into performing an action.

So what would consitute proper CSRF? For this to be useful, you have to get the server to do something - create a user, delete a post, change a setting, whatever. As you say, this would normally require a POST request, but on a poorly designed page it might be possible with GET as well. Anyway, that is what you should be looking for!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.