Exploiting CSRF on DELETE Request

Question

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and sent a empty parameter, it was accepted and the Doc got deleted.

Is there any possibilities for a exploit ?

Thanks in Advance.

Answer 1

The simplest CSRF vector would look something like this:

<img src="https://exam[email protected]&amount=100000">

Then you just need to get this bit of HTML in front of the victim. However this will generate a GET request. If the endpoint uses POST you could try something like (example only - not tested):

<form action="https://[email protected]&amount=10000" method="POST" onload="this.submit()">
</form>

Unfortunately that will only get you GET/POST. To submit a DELETE request you need actual javascript. In general you could just host code like that on any website anywhere, so you don't need an XSS vulnerability. CORS would block the javascript on your page from reading the response, but as long as the request is sent it won't matter. Unfortunately things get more complicated for a DELETE request because it is a non-standard request and triggers additional CORS behavior.

If you try to send a cross-domain DELETE request via Javascript from a cross-domain origin, the browser will first send an OPTIONS request to ask the server if such a thing is allowed. Therefore, as long as the destination server is properly checking the HTTP verb, it will never accept your request. The server will respond to the OPTION request, it will not have white-listed the domain your Javascript is hosted on, and a DELETE request will never be sent. As a result, a CSRF token is not strictly required in this circumstance. However there are a few things that can change that:

1. If the server has misconfigured CORS that responds to the browser and allows all domains in the wrong way, your DELETE request will fire anyway
2. If your javascript runs on the actual domain, then CORS won't happen (but that would be an XSS vulnerability, which beats CSRF anyway)

In short, this would only be vulnerable in the light of additional misconfigurations. It still isn't a great idea, because someone down the line may decide to convert all DELETE requests into POST requests, and forget to add the CSRF check, but it is probably safe as-is.