1

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and sent a empty parameter, it was accepted and the Doc got deleted.

enter image description here

Is there any possibilities for a exploit ?

Thanks in Advance.

  • It sounds like you already exploited it (unauthorised access to file functions). What kind of exploit were you expecting? – schroeder Aug 26 at 17:57
  • The request is sent as DELETE so I'm having hard time understanding this function actually For example, I must sent a crafted html file so when the victim clicks it. It must delete the Doc If I manually remove the csrf token yah it works, but how it works on victim's case – None_None Aug 26 at 18:07
  • 1
    It's generally not possible to leverage csrf on methods different than GET or POST. The server would have to be badly configured and send too laxative CORS headers. – Xavier59 Aug 26 at 18:59
1

The simplest CSRF vector would look something like this:

<img src="https://example.com?send_money_to=myself@me.com&amount=100000">

Then you just need to get this bit of HTML in front of the victim. However this will generate a GET request. If the endpoint uses POST you could try something like (example only - not tested):

<form action="https://example.com?send_money_to=myself@me.com&amount=10000" method="POST" onload="this.submit()">
</form>

Unfortunately that will only get you GET/POST. To submit a DELETE request you need actual javascript. In general you could just host code like that on any website anywhere, so you don't need an XSS vulnerability. CORS would block the javascript on your page from reading the response, but as long as the request is sent it won't matter. Unfortunately things get more complicated for a DELETE request because it is a non-standard request and triggers additional CORS behavior.

If you try to send a cross-domain DELETE request via Javascript from a cross-domain origin, the browser will first send an OPTIONS request to ask the server if such a thing is allowed. Therefore, as long as the destination server is properly checking the HTTP verb, it will never accept your request. The server will respond to the OPTION request, it will not have white-listed the domain your Javascript is hosted on, and a DELETE request will never be sent. As a result, a CSRF token is not strictly required in this circumstance. However there are a few things that can change that:

  1. If the server has misconfigured CORS that responds to the browser and allows all domains in the wrong way, your DELETE request will fire anyway
  2. If your javascript runs on the actual domain, then CORS won't happen (but that would be an XSS vulnerability, which beats CSRF anyway)

In short, this would only be vulnerable in the light of additional misconfigurations. It still isn't a great idea, because someone down the line may decide to convert all DELETE requests into POST requests, and forget to add the CSRF check, but it is probably safe as-is.

| improve this answer | |
  • 1
    “someone down the line may decide to convert all DELETE requests into POST requests, and forget to add the CSRF check, but it is probably safe as-is.” – This sounds a bit like webapps-for-beginners.rubymonstas.org/resources/… ... So yes, this can happen even automatically if you don't your software stack well... – v6ak Sep 3 at 23:17
  • @v6ak that would certainly cause confusion! I've seen that pattern in other frameworks and it also baffles me. I get that people would like to use more specific HTTP verbs in their forms, but stapling a non-standard work around to fake a missing standard just seems like it causes more problems than it solves – Conor Mancone Sep 3 at 23:55
  • Well, I would sum it up: 1. Magic sucks. 2. You need to either understand all the magic or stay high-level (and hope they got your case covered well). 3. This sucks especially. If it was in Rails, then maybe OK – maybe you could just go reasonably high-level and don't care about that. But it is in Rack, which is quite much low-level... – v6ak Sep 4 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.