Say a website has the following form on their sign-up page:
<form method="POST" action="https://example.com/login/">
<input type="hidden" name="x-csrf-token" value="[token]"/>
<input type="hidden" name="firstName" value="[first name]"/>
<input type="submit" value="Submit">
We know for a fact that the firstName value is susceptible to XSS. If I type in <script>alert(1)</script>
, I get a dialog box.
However, I only get this dialog box on the next page, https://example.com/login/2
.
Can the XSS on this website be used to steal the x-csrf-token and submit the form, even if the token is only generated on the first page? The end goal would be to have the attacker host a website with a maliciously crafted form, which would force the victim to make a POST request with the XSS in firstName being used to steal their CSRF token.