2

I found that this application has not properly configured CORS, an attacker can send requests from any origin and allow credentials header is also true.

The idea was to extract CSRF token and then change email/phone to takeover the account and then report this to the company, but the problem is I can't find CSRF token in source code, it not there. It's being sent to requests when I saw in burp history but I can't find in source code. My assumption is CSRF is being generated dynamically by JS and then sent to the server but how would server identify this as a valid token as it was dynamically generated at client side via JS Or am simply making wrong assumption, what you think?

Secondly, is there any other way to exploit CORS and show impact to the company?

6
  • It doesn't have to be in the source but it has to be somewhere. The application may be making a request for a CSRF token (so check all requests/responses) or it may be getting it from a cookie set by the application (double cookie pattern). In short, check all sources of data for the front-end app Commented Jun 9, 2020 at 18:26
  • Need more details. Is the application a web api? How is the token being sent? By "source code" do you mean the web page code, or are you looking at the source code of the application itself? Tokens can be set in cookies and in http headers. It's unlikely that it's being generated by javascript since creating the token client-side undermines its entire purpose.
    – 8vtwo
    Commented Jun 9, 2020 at 18:27
  • @ConorMancone Just checked, it's being sent in both header and POST body parameter. But as an attacker when I would send XHR request from another domain to grab the token it would return the web page's source code and its not there.
    – Jack
    Commented Jun 9, 2020 at 18:53
  • @8vtwo token is being sent in a header and in as a POST para. By source code I mean web page's source code.
    – Jack
    Commented Jun 9, 2020 at 18:55
  • So to clarify, you say (in your comments to @8vtwo) that when the user logs in they get a CSRF token in the response header. Most likely this means that the token doesn't rotate with each request but is fixed on login, which is not normal but not actually terrible. This means that in order to capture the token you probably need to capture the login response, which of course you can't do. So despite the weakness caused by the CORS misconfiguration you may not be able to exploit CSRF. Commented Jun 9, 2020 at 19:24

1 Answer 1

1

According to what you've said in the above comments, I am fairly certain token is being sent in an HTTP RESPONSE header. Either it will be its own CSRF header, or within a Set-Cookie header. This is common practice.

When you pull the webpage you are getting the source code and not finding the token, but you need to check all the HTTP headers on that request to get the token.

It is very unlikely that the token is being generated by client-side javascript. So it has got to be in the HTTP headers.

EDIT: Of course it is also possible that the token will not be sent at all if the request is from an untrusted origin. This would effectively mitigate your attack.

7
  • As mentioned in above comments, token is being sent in a header and as post para, But as an attacker when I would send XHR request from another domain to grab the token it would return the web page's source code and its not there
    – Jack
    Commented Jun 9, 2020 at 19:04
  • 1
    It's being sent back as a header, but also it's being RECEIVED as a header. When you send the request from another domain, are you looking at the HTTP response headers?
    – 8vtwo
    Commented Jun 9, 2020 at 19:05
  • When I login, the login request is sent to an API subdomain and it responds with token. When I send XHR request from another domain and check it's response header, it's not there and usually any application won't respond with token in all subsequent requests.
    – Jack
    Commented Jun 9, 2020 at 19:12
  • It's the client who sends token in all subsequent requests.
    – Jack
    Commented Jun 9, 2020 at 19:13
  • in jQuery you can get jqXHR (headers) from .done(), or .error() methods. api.jquery.com/jQuery.ajax/#jqXHR Commented Jun 9, 2020 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .