At work we suspect a GWT app (that is not in production yet) we own to be vulnerable to CSRF. We have to look at it from a black-box point of view before a third-party security audit will be performed.
Due to the fact that all calls in the app are made through AJAX (with method POST), simply replicating an Ajax call in a malicious way is not achievable thanks to the Same-Origin policy. In fact we know that there is no csrf protection, but since only the request bodies ("payload" in the network tab of Chrome) are read by the server, it feels at first glance that the vulnerability cannot be exploited.
Is there a way to forge a similar request through a browser with a classic form ? My problem is that I cannot replicate the body of the Ajax call through a form : the app reads the body of the requests - submitting a classing form requires inputs with key/value pairs which would not be taken into account by the server.
In other words, is it possible, with an html form, to submit a request that just contains text in a body, instead of key-value pairs in the body ? Or is there another attack angle for such cases ?
Edit (additional info):
The clicks on buttons of the application generate requests that use
text/x-gwt-rpc; charset=UTF-8 as
content-type which, I suppose, is what gwt RPC call handlers expect, and cannot be "forged" with a normal browser (of course such a request could be forged without a browser, but that is OK, since I'm just trying to exploit a potential CSRF).
What notably bothers me is the fact that I know that there are no CSRF tokens in the requests, and that there could exist a tricky way to forge the malicious requests - but I don't see how.