CODEWITHSUNDEEP
iframecross-domaincsrf
Boris Burkov
Boris Burkov

Reputation: 14506

How to implement an XSRF attack via auto-submitting form in iframe?

I'm working on a Single-Page App and choosing, what scheme to use for user sessions, cookie or localstorage. In particular, I'm considering CSRF attack scenario. The most reasonable CSRF attack scheme IMHO is auto-submitting a form in an invisible iframe. But how does it work?

Suppose that I'm the developer of maliciouswebsite.net and on my page I'm creating an invisible iframe pointing to some page at bank.com website with the intention to make user, visiting maliciouswebsite.net and logged in on bank.com, to unwillingly send his money to me by auto-submitting the form in an invisible iframe.

But in such case the code in iframe won't be scriptable from maliciouswebsite.net, because it will be considered Cross-Origin and browser won't allow javascript in the main frame of maliciouswebsite.net to manipulate with elements of bank.com invisible frame.

A different scenario is that maliciouswebsite.net just presents an invisible iframe with form action=bank.com/api/transfer_money?.... So the Origin of this iframe is still maliciouswebsite.net. But in such case the form won't see the user's cookie at bank.com and won't be allowed to do anything, right?

Upvotes: 0

Views: 558

Answers (1)

SilverlightFox
SilverlightFox

Reputation: 33578

A different scenario is that maliciouswebsite.net just presents an invisible iframe with form action=bank.com/api/transfer_money?.... So the Origin of this iframe is still maliciouswebsite.net. But in such case the form won't see the user's cookie at bank.com and won't be allowed to do anything, right?

Yes, this is how it were to work should an IFrame be used.

Basically it starts off with a page with a form on that auto submits to another domain, like you say. See this answer for an example.

Then so as to not alert the user that the form is being submitted, the attacker embeds the page with that form in a hidden IFrame.

The browser will automatically send cookies, as long as the user is already logged into bank.com. Remember, the form does not need to see cookies (maliciouswebsite.net), only the target domain does (bank.com).

Upvotes: 1

Related Questions