What is the risk for a form changing password with an old password input that doesn't have CSRF protection?
A form without an old password input, I understand the risk but if the old password input is present, what is the risk?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You're on the correct train of thought, in that as long as there is an element to the request that is not guessable/shared between users CSRF isn't possible. The issue at the core of CSRF is that cookies are sent automatically by the browser, which is a problem when the cookies are the only part of the victim's request that an attacker doesn't know.
Depending on your application, there may be some cases where not having a CSRF token on your password change request opens up some surface area for an attacker. Assuming that an attacker has a user's password:
the attacker can CSRF the victim and change their password on your application, which would bypass 2 factor authentication.
if your service alerts users about suspicious logins (e.g. from new browsers/regions), CSRFing the password change would not trigger an alert.