0

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF attack on logged-in users so that the victims are tricked into changing their passwords.

But, given no other flaws on the web application, can the attacker learn the victim's username so that he can actually login with the new password set by the attacker?

Improve this question
1
  • 1
    If the username is completely random then it will be difficult to guess it. The only way would be to obtain the username via social engineering methods. BUT still due to CSRF vulnerability the attacker can lock the user out of his account by changing the password. Assuming the victim doesn't know he was attacked otherwise he can check the code of html page that is send to him by attacker. – 3lokh Apr 12 '19 at 18:23
2

Yes. Imagine spearphishing a high-profile user whose username you already have. All you need is to send them to your crafted CSRF page and you have taken over their account. Or equivalently, a mass phishing campaign if the web application accepts your email address as an alternative username.

CSRF on security-critical flows is incredibly dangerous. You are counting on username behaving like a secret value when it (nearly always) does not. Also see user enumeration vectors, etc.

Improve this answer
2
  • I'm not underestimating the risk of a CSRF attack! I just wanted to know if I have to learn the username via a different channel or if I can learn it via the same attack vector. – HorstKevin Apr 13 '19 at 9:48
  • 1
    It is unlikely you can obtain the username directly via the CSRF vector (unless you have access to a subdomain takeover and the cookies for the site are inappropriately scoped). You will likely need to chain it with another vulnerability such as user enumeration or open-source information gathering. – ConsideredHarmful Apr 16 '19 at 2:50
1

Without anti-CSRF in place, the attacker does not need the username. He only needs to trick the user into accessing a page he controls while logged in.

A page with something like this would work:

<iframe style="display:none" name="passframe"></iframe>
<form method='POST' action='http://vulnerable.com/pass.php' target="passframe" id="passform">
  <input type='hidden' name='password1' value='123456'>
  <input type='hidden' name='password2' value='123456'>
  <input type='submit' value='submit'>
</form>
<script>document.getElementById("passform").submit()</script>

If the user is logged in and lands on this page, his password will be changed.

Improve this answer
2
  • 1
    Yes, this is how the attack works. But, through this attack, the attacker hasn't learned the username yet. Can the attacker login with the password '123456'? Can the attacker takeover the account? – HorstKevin Apr 12 '19 at 15:14
  • This assumes that the attacker cannot guess the username. Many, if not most websites, use the user's email address as the username. Also, the presence of some other information disclosure vulnerability may make it possible for an attacker to obtain the username. – Dan Landberg Apr 12 '19 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.