Bypassing the weak CSRF Protection

Hi there,

So in InfoSec community everybody knows about the CSRF vulnerability.
And if the website is not using the CSRF protection they are lucky to find the Full account takeover using the CSRF.

However many of Security Researcher only look if there is a CSRF token present on a particular request or not. And if it was not they think that this particular request is vulnerable to CSRF.

Protection which Modern WebApp uses against CSRF

So there are many protection which modern WebApp use against CSRF.

1. Send an Authenticity token which each request:- So this is the basic protection which most of WebApp use. They send a Authenticity token with each request to protect their users against CSRF.

2. X-CSRF Token:- Many Webapp use this extra layer of protection by adding a X-CSRF token header with each request the token in the header is verified on every request sent to server.

3. Referrer Header Protection:- You can only find this type of CSRF protection in some of the WebApp like Twitter. In this type of protection they verify the referrer header and if the referrer header is coming from any other domain besides the domain of the Website. It drops the request and shows an error.

Some Methods to Bypass the CSRF protection

There are some methods which you can use to bypass the csrf protection

1. There are many webapp which only verifies the length of the CSRF token which means create an account on that website and note down the length of the CSRF token. Now SEnd any arbitrary CSRF token of the same length and it will get accepted.

2. You can also use GET method instead of POST method to bypass CSRF protection.

3. There is missing best practice in many of the website. After logging in they generate a CSRF token for us and this token remains same on every request until we do logout. But if we note down the same token and try a CSRF attack on any other persons account it will be successful.

So from my opinion CSRF token should have to be unique per use and they have to expire after use does the logout.

4. There is also a flaw exists which makes many Webapp vulnerable which generates the CSRF token and then save them to cookie and on each and every request they verifies the token in the POST request with the token in the cookie.

So it is easy to bypass this type of protection just change both token one which is inside the cookie and the other which is sent to the server on every request. And the request will be successful.

SO to mitigation  you dont have to just match the token with the token in the cookie.

Suggestion are welcome

Thanks 

Jitendra K Singh(Team Computer Korner)

Feel Free To Leave A Comment If Our Article has Helped You, Support Us By Making A Small Contribution, Thank You!