Weird JSON CSRF technique- BugBounty write-up
How I exploit the JSON CSRF with method override technique
Introduction — CSRF:CSRF(Cross-Site Request Forgery) is a kind of web application vulnerability, using this a malevolent can forge the HTTP request without the actual user knowledge. This will result in a serious security flaw in the web application.In this write up I will explain how to identify the JSON CSRF vulnerability and the challenge I face to escalate this bug in a recent project.Generally, the JSON CSRF is not always possible in every web application that uses the JSON body. Mainly it depends on the authentication mechanism. To identify this, we have to make sure that the HTTP request satisfies the below conditions.The authentication mechanism should be in the cookie-based model. (By default cookie-based authentication is vulnerable to CSRF attacks)The HTTP request should not be fortified by the custom random token on the header as well in the body.The HTTP request should not be fortified by the Same Origin Policy.“If the above conditions were satisfied we can directly forge the JSON request by simply making an Ajax request from the other Origin.”Note: These are the primary conditions to achieve the CSRF in JSON. But It is possible to exploit the JSON CSRF even though 2nd and 3rd points are not satisfied.Challenges I faced to exploit the JSON CSRF in…