4 ms·

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a lin

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well? https://mail.google.com/mail/u/0/?logout https://mail.google.com/mail/u/0/?logout

homakov 15y ago
It has nothing to do with future posts, I repeat...
ketralnis 15y ago
I interpret CSRF (cross-site request forgery) to be different from XSS (cross-site scripting). This particular vulnerability is indeed a CSRF, but not an XSS which is what it sounds like you're confusing it for.
christianmann 15y ago
Cross site scripting (XSS) is not the same thing as CSRF. If you were to do that, it wouldn't be a CSRF, because the action originated with the user. Normally CSRFs are automatic, either in the form of an image (<img src="https://...?logout https://...?logout />) or an iframe src attribute. So, if you included the above image tag on your page, then it would be a CSRF, sometimes also called a Confused Deputy Attack.
gibybo 15y ago
Cross site request forgery is separate from cross site scripting. He is not clamming to have done any cross site scripting. Secure sites generally require a token to perform any state changing effects, it's just odd that Google doesn't require it for logging out. Facebook uses http://facebook.com/logout.php http://facebook.com/logout.php to log you out, but clicking that link won't do it.
streptomycin 15y ago
If Google would prefer that any random website can't log its users out of its services, then yes, it's a CSRF vulnerability.
jey 15y ago
The other replies to your post are focusing on the fact that you mistakenly used "cross site scripting" in your post, but you raise a valid point: is it really a problem to cause a GET request to that URL? It would be a lot more convincing if he used a POST to a URL that seemed to be doing the normal sanity checks, like if he caused Gmail to send a mail. Right now his example is unconvincing because it's possible that the Google guys just allow logouts via GET because it's relatively harmless to log someone out.

homakov 15y ago

It has nothing to do with future posts, I repeat...

ketralnis 15y ago

I interpret CSRF (cross-site request forgery) to be different from XSS (cross-site scripting). This particular vulnerability is indeed a CSRF, but not an XSS which is what it sounds like you're confusing it for.

christianmann 15y ago

Cross site scripting (XSS) is not the same thing as CSRF. If you were to do that, it wouldn't be a CSRF, because the action originated with the user. Normally CSRFs are automatic, either in the form of an image (<img src="https://...?logout https://...?logout />) or an iframe src attribute. So, if you included the above image tag on your page, then it would be a CSRF, sometimes also called a Confused Deputy Attack.

gibybo 15y ago

Cross site request forgery is separate from cross site scripting. He is not clamming to have done any cross site scripting. Secure sites generally require a token to perform any state changing effects, it's just odd that Google doesn't require it for logging out. Facebook uses http://facebook.com/logout.php http://facebook.com/logout.php to log you out, but clicking that link won't do it.

streptomycin 15y ago

If Google would prefer that any random website can't log its users out of its services, then yes, it's a CSRF vulnerability.

jey 15y ago

The other replies to your post are focusing on the fact that you mistakenly used "cross site scripting" in your post, but you raise a valid point: is it really a problem to cause a GET request to that URL? It would be a lot more convincing if he used a POST to a URL that seemed to be doing the normal sanity checks, like if he caused Gmail to send a mail. Right now his example is unconvincing because it's possible that the Google guys just allow logouts via GET because it's relatively harmless to log someone out.