First of all, CSRF attacks do not require any JavaScript at all. You can forge arbitrary requests with pure HTML to send arbitrary GET or POST requests via simple images or simple forms.
JavaScript would only be helpful to automatically send the latter forms as are not send automatically like a request for an image would. But you could also style the form’s submit button to span the whole page and make it transparent so that it won’t be seen by the user but if he clicks somewhere on the page, the form will be send.
In most cases, sending the forged request is sufficient for the attacker as the intention is to simply trigger an action in behalf and session context of the victim. For this a simple HTML form is sufficient.
But with JavaScript, the Same-Origin Policy comes in play, which makes it much more difficult. The origin is determined on the document’s URI (i.e., the scheme, host, and port). Only if the origin of two documents or resources are identical, the two documents/resources are same-origin. If they are not same-origin, the Same-Origin Policy basically disallows any XHR requests or direct access via DOM (e.g. frames).
With the second version of XMLHttpRequest (XHR), the technology used with Ajax, cross-origin requests were permitted under certain circumstances defined in Cross-Origin Resource Sharing. The basic rules are that simple cross-origin requests are allowed while other require a preflight request before the actual request. That preflight is used to determine whether the server would accept the actual request. Only if that preflight request succeeds, the actual request is send.
However, even if it’s only a simple request and the request succeeds, the server may still disallow the browser to make the response available to JavaScript, again via certain response header fields defined in CORS.
As for CSRF attacks, especially the latter type of cross-origin requests are worthy as those would contain user credentials like HTTP authentication information, cookies, etc., which would be required to trigger privileged actions on the server. But unless the resource allows such cross-origin requests, the browser won’t allow JavaScript to send these.
So the conclusion is:
- CSRF does not require JavaScript, however it makes automatic exploitation much easier.
- Simple HTML based request forgery is much more promising due to the lack of conformance with the Same-Origin Policy, which JavaScript requires.
- Reading the response is only possible with JavaScript but it requires the resource to allow it, especially if user credentials are required.