Let's say there is an XSS vulnerability in an application, and the application is not using any kind of CSRF token, just using the referer header to protect against CSRF. Referer header is validating properly. So in this case can we bypass the referer header to perform the CSRF? If yes, then how?
Because OWASP always recommends token to prevent CSRF...
If there is an XSS vulnerability, the attacker has won. If you can execute arbitrary JavaScript on the victims machine in the target origin, you can do whatever you want - you don't need to bypass any CSRF protection to wreak havoc.
Also, no CSRF protections survive an XSS vulnerability. A referer header check does not help, since the attacker can just send the requests with the injected script, so they will have the right referer. A CSRF token doesn't help either, since it can easily be exfiltrated.
In short, XSS > CSRF.
