3 ms·
Any site that has a GET route to /logout that does not check the referrer is vulnerable to this iframe/img attack.
by vortico 7y ago
Any site that has a GET route to /logout that does not check the referrer is vulnerable to this iframe/img attack.
- yjftsjthsd-h 7y agoIt really shouldn't be GET anyways; that's asking for trouble.
- iwalton3 7y agoSome of the pages that are exploited do use POST though. If it accepts authorization through a cookie and doesn't require an XSRF token or JSON content type, it is probably vulnerable. But yes in general making actions happen in response to a GET request is generally a bad idea, since these are often cached and considered "safe" to retry.
- _jomo 7y agoPlease don't rely on the Referer being present (ever). It's an optional header to send in a request and you can configure your browser — at least Firefox — to not send it for privacy reasons. Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.
- throwaway63839 7y agoNot true. Using samesite cookie attribute prevents CSRF through IMG tags. (On browsers that support samesite, i.e. most browsers.)