0

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.

Can CORS Anywhere able to bypass CSRF protections?

Reason to ask the question here:

Simple, for learning and also for breaking things and then applying a proper fix.

So I am testing my Collage's web site to make it more secure and after some time I noticed the application was preventing CSRF attacks by checking the Content-Type:application/json header.

It doesn't check CSRF tokens. I can use other users CSRF tokens in same requests.

Attempt:

I tried changing Content-Type:application/json to Content-Type:text/plain but it not worked. The response come as Content-Type:text/plain not allowed.

I also tried changing the POST method into GET but it did not work either.

Also this site doesn't have crossdomain.xml File. So flash based trick no chance.

Suggestions are highly appreciated.

0

Try this xhr.setRequestHeader("Content-Type", "text/plain; application/json");

If it doesn't work try the Flash trick even if the website doesn't have crossdomain.xml check this https://github.com/sp1d3r/swf_json_csrf and this https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flash/

0

Can CORS Anywhere able to bypass CSRF protections?

Nope!

Bypassing the Same Origin Policy (and other data exfiltration attacks) and CSRF attacks are both impossible using the CORS Anywhere service.

Both of the attacks you describe require the attacking page to be logged in (authenticated) as a victim user in order to be useful. (If you aren't signed in, you could just access the page normally with a web browser without any 'attacks')

As a result, cookies, which make someone logged in, need to be sent in all the attacker's requests.

In the case of a Cross-Site Request Forgery attack, this is done by the browser automatically unless otherwise requested. However, the attacking page never actually gets to see the cookies of the victim page.

To use CORS Anywhere, you send a request to CORS Anywhere, and it will forward your request to the target site. If you, as the attacker, cannot see the cookies of the victim page, you cannot send those cookies to a service like CORS Anywhere. As a result, CORS Anywhere cannot send the cookies to the victim page, and so the victim page wil respond as if you are signed out. The attacks you describe cannot be performed while signed out.

tried changing Content-Type:application/json to Content-Type:text/plain but it not worked. The response come as Content-Type:text/plain not allowed.

This can maybe be bypassed, but not using CORS Anywhere. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.