2

Without giving too many details away, let's say that I'm auditing an API that:

  • Has access-control-allow-credentials: true
  • Has access-control-allow-origin: *
  • Needs JWT set in Authorization header for request to all endpoints

With this scenario, CSRF is not possible since JWT is not in the cookies, so the client's browser does not send it.

HOWEVER

  • There is access-control-allow-headers: Authorization
  • There is also a button that, when clicked, the JWT gets stored as a cookie, and it has not HttpOnly set.

The API is not vulnerable to any kind of XSS.

My question is: Is it possible to steal such JWT (that now is in a cookie)?

I'm a bit tangled up with CORS, CSRF and HttpOnly.

1 Answer 1

2

CSRF by itself does not allow stealing a cookie, no matter if HttpOnly or not. CSRF only allows an attacker to issue a request to the cookies domain which includes the cookie, same as requests to the cookie domain issued by the true user do. It thus allows issuing requests with the identity of the true user within the users browser, but not stealing the identity to use it outside the original browser environment.

A cookie without HttpOnly might be stolen by the attacker running its own script within the cookies domain - but this would be XSS not CSRF. A cookie might be stolen by sniffing the traffic between the browser and the cookies domain - but this would be an MITM attack, not CSRF. The cookie value might be somehow exposed by the server where the cookie is sent to - but this would be an information leak and not CSRF.

2
  • One more idea: a resource that supports method override (with TRACE as a valid value for the overriding method) and has a very permissive CORS config (e.g. all origins allowed with credentials). Essentially, XST + CORS misconfig.
    – jub0bs
    Apr 4, 2023 at 19:16
  • Another way to leak a HttpOnly cookie by abusing a parser differential: blog.ankursundara.com/cookie-bugs/#cookie-smuggling
    – jub0bs
    May 11, 2023 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .