the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 507
significant as one specifically designed for administrators to execute arbitrary
SQL queries. If a query can be injected that performs some sensitive action,
or that retrieves data via some out-of-band channel, this attack can be performed
by nonadministrative users via CSRF.
Authentication and CSRF
Since CSRF attacks involve performing some privileged action within the context
of the victim user’s session, they normally require the user to be logged in to
the application at the time of the attack.
One location where numerous dangerous CSRF vulnerabilities have arisen
is in the web interfaces used by home DSL routers. These devices often contain
sensitive functions, such as the ability to open all ports on the Internet-facing
firewall. Since these functions are often not protected against CSRF, and since
most users do not modify the device’s default internal IP address, they are
vulnerable to CSRF attacks delivered by malicious external sites. However, the
devices concerned often require authentication to make sensitive changes, and
most users generally are not logged in to their device.
If the device’s web interface uses forms-based authentication, it is often possible
to perform a two-stage attack by first logging the user in to the device and then
performing the authenticated action. Since most users do not modify the default
credentials for devices of this kind (perhaps on the assumption that the web
interface can be accessed only from the internal home network), the attacker’s
web page can first issue a login request containing default credentials. The device
then sets a session token in the user’s browser, which is sent automatically in
any subsequent requests, including those generated by the attacker.
In other situations, an attacker may require that the victim user be logged
in to the application under the attacker’s own user context to deliver a specific
attack. For example, consider an application that allows users to upload and store
files. These files can be downloaded later, but only by the user who uploaded
them. Suppose that the function can be used to perform stored XSS attacks,
because no filtering of file contents occurs (see Chapter 12). This vulnerability
might appear to be harmless, on the basis that an attacker could only use it to
attack himself. However, using CSRF techniques, an attacker can in fact exploit
the stored XSS vulnerability to compromise other users. As already described,
the attacker’s web page can make a CSRF request to force a victim user to log
in using the attacker’s credentials. The attacker’s page can then make a CSRF
request to download a malicious file. When the user’s browser processes this file,
the attacker’s XSS payload executes, and the user’s session with the vulnerable
application is compromised. Although the victim is currently logged in using