Exploiting insecure crossdomain policies to bypass anti-CSRF tokens
In my last post, I mentioned that if a site hosts an insecure crossdomain.xml file, you can exploit that flaw to bypass same origin policy and among other things, you can read anti-CSRF tokens. Because your Flash object can read the anti-CSRF token, it can extract the token from the response and use it in future requests. In fact, this is almost identical to how you can bypass CSRF tokens with XSS. I recently came across a popular website that met these criteria, and I created a POC to send to the security team. The site protected itself against CSRF using anti-CSRF tokens, but they had a wide open crossdomain.xml file. I'll post the details later, but I wanted to drop the template here, in the event anyone wants to give it a try: // Original POC Author: Gursev Singh Kalra (gursev.kalra@foundstone.com) // Modified to bypass antiCSRF tokens: Seth Art (sethsec@gmail.com) // BypassCSRFchangeEmailAddress .as package { import flash.display.Sprite ; impo...
