If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage.
The hacker can't get the session cookie of the admin, because it's flagged httponly and the server doesn't allow TRACE method.
However the attacker can use CSRF to force the admin to create a user in the application.
Most of CSRF controls will make it only difficult for the hacker but not impossible;
- synchronizer token and viewstate could be easily stolen with ajax requests since they are sent from the same domain.
- Referrer and Origin validation is also not applicable.
- any other multi-step request could be simulated with ajax.
- Double submits are also vulnerable, since the browser send the cookies by default.
- CAPTCHAs are difficult, but theoretically they can be cracked using mechanical turks.
The only control that seems to work is asking the admin's credentials each time a sensitive request is made. But, does creating a user is a sensitive request? Or changing someones password? may be it's a daily task..
Any insights about this topic? can we prevent against CSRF via stored-XSS?