{"id":968,"date":"2013-05-23T17:57:13","date_gmt":"2013-05-23T15:57:13","guid":{"rendered":"https:\/\/www.asafety.fr\/?p=968"},"modified":"2016-07-25T00:41:36","modified_gmt":"2016-07-24T22:41:36","slug":"csrf-referer-token-protection-bypass-with-xss","status":"publish","type":"post","link":"https:\/\/www.asafety.fr\/en\/vuln-exploit-poc\/csrf-referer-token-protection-bypass-with-xss\/","title":{"rendered":"CSRF Referer & Token protection bypass with XSS"},"content":{"rendered":"

<\/p>\n

Au cours de r\u00e9cents pentests, il m’a \u00e9t\u00e9 possible de contourner certaines protections anti-CSRF par le biais de moyen d\u00e9tourn\u00e9s. Pour pr\u00e9senter ces techniques, un cas concret d’une application web vuln\u00e9rable va \u00eatre d\u00e9taill\u00e9.<\/p>\n

Dans un premier temps, effectuons un tour d’horizon de la vuln\u00e9rabilit\u00e9 CSRF ainsi que les diff\u00e9rents moyens utilis\u00e9s\/pr\u00e9conis\u00e9s pour s’en prot\u00e9ger.<\/p>\n

Pr\u00e9sentation\u00a0succinte\u00a0des attaques CSRF<\/h2>\n

Ce type d’attaque, principalement orient\u00e9e vers les applications web, exploite les privil\u00e8ges d’un utilisateur particulier sans que celui-ci n’en soit conscient pour r\u00e9aliser toutes sortes d’actions. Comme c’est l’utilisateur l\u00e9gitime (administrateur) qui ex\u00e9cute l’action \u00e0 son insu, la plupart des syst\u00e8mes d’authentification sont contourn\u00e9s. La d\u00e9finition de l’OWASP<\/a> est la suivante :<\/p>\n

\n

CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he\/she is currently authenticated. With a little help of social engineering (like sending a link via email\/chat), an attacker may force the users of a web application to execute actions of the attacker’s choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.<\/p>\n<\/blockquote>\n

Ces attaques disposent de quelques caract\u00e9ristiques :<\/p>\n