11

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF.

Example: bank.com has a form like this at https://bank.com/transfer:

<form action="https://bank.com/do_transfer" method="post">
  <input type="hidden" name="synchroniser_token" value="j/DcoJ2VZvr7vdf8CHKsvjdlDbmiizaOb5B8DMALg6s=" >
  <input type="hidden" name="to"                 value="ciro">
  <input type="hidden" name="amount"             value="100">
  <button type="submit">Send 100$ to Ciro.</button>
</form>

This code adapted from https://stackoverflow.com/a/26895980/1512962

What would stop malicioussite.com from GETing https://bank.com/transfer with JavaScript on the client (using the session ID already stored in the cookie) and scrapping the page for the authenticity_token? Then, they could use that ID to do a real CSRF, essentially a CSRF to do another CSRF.

It'd require JavaScript to execute, so it'd be harder to do then a simple 0px X 0px image, but it's more than doable.

18

What stops a malicious site from obtaining the anti-CSRF token is the Same Origin Policy. The Same Origin Policy, or SOP, is at the browser level, and defines where JavaScript is allowed to communicate.

JavaScript on example.com cannot call example.org to get data. Also, JavaScript on http://www.example.com/ cannot call http://www.example.com:8080/ as the port differs. There are further restrictions which are set and can be found here: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy.

There are exceptions to this with Cross-Origin Resource Sharing, but that has its own rules that browsers have to follow. CORS can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS.

|improve this answer|||||
  • 2
    Beat me to it! Nicely written. – ps95 Jul 26 '15 at 18:35
  • Unless the person has an extention that allows executing code on the same page, and that can scrap the document for the token. That way, it can still take the token and send the token as a fake GET request of an image. For example: http://malicious/images/<token>.gif. On the server, you can then receive it and do as you please. – Ismael Miguel Jul 27 '15 at 8:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.