I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the mitigation techniques? Following is the code example:

document.write('<IFRAME SRC="https://somedomain/abcde;src=;type=;cat=;ord=;num='+ a + '?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>');

The code example, you gave is a cross site scripting vulnerability, because it allows the execution of arbitrary JavaScript, assuming "a" is untrusted:

a = "\"); evil(); document.write(\""

A malicious site can use an iframe to exploit a vulnerable site via CSRF:

In a typical CSRF attack, the browser is tricked by a malicious site to submit a request to a vulnerable site. The browser will include the cookies for that site, thus the request is authenticated from the point of view of the vulnerable site.

While there is a number of ways to trigger GET-request, cross site POST request are usually created by submitting a form. While JavaScript can be used to trigger the submission automatically, it cannot be used to hide the result page. So on a simple POST-based CSRF-attack the user will be warned after the fact.

So the trick is to put the malicious auto-submitting form into an invisible IFrame. Therefore the user will not see the webpage showing the submission result.

A related attack is click-jacking: The vulnerable site (e. g. Facebook's like-button) is loaded into a transparent iframe and JavaScript is used to scroll it to the appropriate location and keep it positioned at the mouse cursor. If the user tries to click on anything on the malicious site, it will click on the transparent iframe instead.

  • Thanks Hendrik for the XSS example. That is cool! "So the trick is to put the malicious auto-submitting form into an invisible IFrame. Therefore the user will not see the webpage showing the submission result." Ahh! so that is the stored CSRF where an attacker can make an iframe point to a malcious auto-submit form's URL if that iFrame's URL is getting formed using untrusted request parameters. Hope I got it right? Please correct me if I am wrong. – p_upadhyay Nov 21 '11 at 18:29

An iframe cannot introduce a Cross Site Request Forgery or Cross Site Scripting vulnerability. An iframe is unable to influence an application in this way due to the Origin inheritance Rules for iframes.

iframe's are used by the attacker in a UI Redress attack. Also you should read the CSRF prevention cheat sheet. Especially the part on how XSS can be used to undermine CSRF protection systems.

  • Thanks Rook for the info. XSS can be used to steal the CSRF token and CSRF mitigation can be bypassed. I just got confused with iFrame because I remember I had read somewhere that iframe is used to cause stored CSRF. Thanks for the help though. Appreciate it.. – p_upadhyay Nov 21 '11 at 18:32
  • You’re wrong. You can still trigger forged GET requests with an IFRAME. – Gumbo Nov 23 '11 at 22:33
  • @Gumbo and that is of no added value to the attacker. – rook Nov 24 '11 at 0:00
  • 1
    @Rock, while not related to this topic, iframes have been used in the past for Distributed Denial of Service attacks on a blog, which had exposed the existence of malicious functions in a popular software . – Hendrik Brummermann Nov 24 '11 at 13:59
  • @Hendrik Brummermann♦ Interesting, Chrome has a built in rate-limiter to prevent an attack like this. – rook Nov 24 '11 at 16:46

If the CSRF vulnerable application allows itself to be embedded in an Iframe, then yes. How does it help the attacker?

Iframes can be made invisible by setting size to zero. So as against the normal csrf where victim might get an idea of something suspicious, in case of invisible iframe, he won't see anything.

The attacker will submit the form on victim's behalf where the form will be embedded inside iframe. This is cool.

Infact there is one more trick attacker can use if the application uses a token to prevent CSRF but still allows itself to be framed.

Using the fake captcha method he can trick the user into submitting the token using some social engineering and javascript. Note that this works in firefox only, surprise!!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.