7

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the mitigation techniques? Following is the code example:

document.write('<IFRAME SRC="https://somedomain/abcde;src=;type=;cat=;ord=;num='+ a + '?" WIDTH=1 HEIGHT=1 FRAMEBORDER=0></IFRAME>');
Improve this question

3 Answers 3

Reset to default
9

The code example, you gave is a cross site scripting vulnerability, because it allows the execution of arbitrary JavaScript, assuming "a" is untrusted:

a = "\"); evil(); document.write(\""

A malicious site can use an iframe to exploit a vulnerable site via CSRF:

In a typical CSRF attack, the browser is tricked by a malicious site to submit a request to a vulnerable site. The browser will include the cookies for that site, thus the request is authenticated from the point of view of the vulnerable site.

While there is a number of ways to trigger GET-request, cross site POST request are usually created by submitting a form. While JavaScript can be used to trigger the submission automatically, it cannot be used to hide the result page. So on a simple POST-based CSRF-attack the user will be warned after the fact.

So the trick is to put the malicious auto-submitting form into an invisible IFrame. Therefore the user will not see the webpage showing the submission result.

A related attack is click-jacking: The vulnerable site (e. g. Facebook's like-button) is loaded into a transparent iframe and JavaScript is used to scroll it to the appropriate location and keep it positioned at the mouse cursor. If the user tries to click on anything on the malicious site, it will click on the transparent iframe instead.

Improve this answer
1
  • Thanks Hendrik for the XSS example. That is cool! "So the trick is to put the malicious auto-submitting form into an invisible IFrame. Therefore the user will not see the webpage showing the submission result." Ahh! so that is the stored CSRF where an attacker can make an iframe point to a malcious auto-submit form's URL if that iFrame's URL is getting formed using untrusted request parameters. Hope I got it right? Please correct me if I am wrong.
    – p_upadhyay
    Commented Nov 21, 2011 at 18:29
2

An iframe cannot introduce a Cross Site Request Forgery or Cross Site Scripting vulnerability. An iframe is unable to influence an application in this way due to the Origin inheritance Rules for iframes.

iframe's are used by the attacker in a UI Redress attack. Also you should read the CSRF prevention cheat sheet. Especially the part on how XSS can be used to undermine CSRF protection systems.

Improve this answer
5
  • Thanks Rook for the info. XSS can be used to steal the CSRF token and CSRF mitigation can be bypassed. I just got confused with iFrame because I remember I had read somewhere that iframe is used to cause stored CSRF. Thanks for the help though. Appreciate it..
    – p_upadhyay
    Commented Nov 21, 2011 at 18:32
  • You’re wrong. You can still trigger forged GET requests with an IFRAME.
    – Gumbo
    Commented Nov 23, 2011 at 22:33
  • @Gumbo and that is of no added value to the attacker.
    – rook
    Commented Nov 24, 2011 at 0:00
  • 1
    @Rock, while not related to this topic, iframes have been used in the past for Distributed Denial of Service attacks on a blog, which had exposed the existence of malicious functions in a popular software .
    – Hendrik Brummermann
    Commented Nov 24, 2011 at 13:59
  • @Hendrik Brummermann♦ Interesting, Chrome has a built in rate-limiter to prevent an attack like this.
    – rook
    Commented Nov 24, 2011 at 16:46
0

If the CSRF vulnerable application allows itself to be embedded in an Iframe, then yes. How does it help the attacker?

Iframes can be made invisible by setting size to zero. So as against the normal csrf where victim might get an idea of something suspicious, in case of invisible iframe, he won't see anything.

The attacker will submit the form on victim's behalf where the form will be embedded inside iframe. This is cool.

Infact there is one more trick attacker can use if the application uses a token to prevent CSRF but still allows itself to be framed.

Using the fake captcha method he can trick the user into submitting the token using some social engineering and javascript. Note that this works in firefox only, surprise!!

http://blog.kotowicz.net/2011/07/cross-domain-content-extraction-with.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .