Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

Question

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any cookies set before:

var xhr = new XMLHttpRequest();
xhr.open("POST", "http://mysite.vulnerablesite.com/mysite/deleteUser");
xhr.withCredentials=true;
xhr.send(["userId=5"]);

If you test this on a browser, you will get an error on the console ( Cross-Origin Request Blocked), but the request will actually be sent. What you are not allowed is just to see the result of the request.

If this is not a problem of the spec, or a chromium/firefox implementation issue, then what should be the protection from such attacks?

Answer 1

You don't need an AJAX request, the standard approach to exploit this issue would be:

<form id="myform" method="post" action="http://mysite.vulnerablesite.com/mysite/deleteUser" >
    <input type="hidden" name="userId" value="5">
</form>
<script>document.createElement('form').submit.call(document.getElementById('myform'));</script>

You can also send JSON formatted values (use enctype="text/plain"). You cannot however change the Content-type header to JSON or add a custom header like x-requested-with: XMLHttpRequest. The thing is, you can't do that with your AJAX example either.

In your example, the browser sees that you are sending a request that is perfectly allowed, so it doesn't ask the receiving server for its CORS policy (thus saving a request). It just sends the request and - depending on the response - allows or disallows reading of the response.

Now, if you were to add a custom header like xhr.setRequestHeader("x-requested-with", "XMLHttpRequest"), then you are asking the browser to do something which may violate the cross origin policy. Now, the browser will first issue a preflight OPTIONS request. If it is allowed to perform a request it will do so, otherwise it will not.

To prevent CSRF, you should use some token based defense. Because of the way CORS works, you could also check the presence of special HTTP header like XMLHttpRequest for a less secure CSRF protection.