Can XSS mitigate all anti-CSRF protections?

Question

Say a website has the following form on their sign-up page:

<form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input type="hidden" name="firstName" value="[first name]"/> <input type="submit" value="Submit">

We know for a fact that the firstName value is susceptible to XSS. If I type in <script>alert(1)</script>, I get a dialog box.

However, I only get this dialog box on the next page, https://example.com/login/2.

Can the XSS on this website be used to steal the x-csrf-token and submit the form, even if the token is only generated on the first page? The end goal would be to have the attacker host a website with a maliciously crafted form, which would force the victim to make a POST request with the XSS in firstName being used to steal their CSRF token.

Answer 1

Assuming you can reach the second page without needing a cookie or other stateful artifact of going through the first page, yes, you absolutely can do that. Use XMLHttpRequest or fetch to retrieve the user's view of the first page, extract the CSRF token, and then use it to POST the values you want. Alternatively, inject an iframe for the first page into the second (it can be invisible to the user), and then you can read the iframe's contents and manipulate its DOM, because it is same-origin.

Alterntively, for login CSRF, just programmatically set the session cookie in the XSS payload. Login CSRF matters, but only after you have completely eliminated XSS and usually post-authentication CSRF matters a lot more, too. Sign-up CSRF is basically a weird case of login CSRF.