New answers tagged

2

Your vulnerability doesn't do anything in practice. Conor already explained in his answer that Login CSRF doesn't really exist, but I think that's not the full story. You mentioned a self-XSS vulnerability in the profile, which leads me to believe that your attack vector looks as follows: Lure the victim to your site Abuse a CSRF vulnerability to log the ...


3

Yep, indeed the scenario is enough to say that the web app is vulnerable to Login/Logout CSRF. ViewState and EventValidation are not meant to protect against CSRF (I guess it's a .net/asp(x) application). In fact ViewState is used to track and restore the state values of controls that would otherwise be lost, either because those values do not post with the ...


Top 50 recent answers are included