CSRF Attacks: Bypassing SameSite Cookies

Introduction to CSRF

Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit malicious requests. Attackers exploit the trust a web application has in the user’s browser.

How CSRF Works

1. User logs into a vulnerable website (e.g., bank.com)
2. Session cookie is stored in the browser
3. User visits attacker’s page containing malicious request
4. Browser automatically includes the session cookie with the request
5. Vulnerable server processes the request as legitimate

SameSite Cookies Protection

The SameSite cookie attribute was introduced to mitigate CSRF attacks by restricting when cookies are sent with cross-site requests.

Bypassing SameSite Restrictions

1. Exploiting Lax Policy with GET Requests

The Lax policy allows cookies to be sent with top-level navigation via GET requests:

<img src="https://vulnerable.com/transfer?amount=1000&to=attacker">

2. Using 307/308 Redirects

HTTP 307/308 status codes preserve the method and body of the original request during redirects:

POST /malicious-form HTTP/1.1
Host: attacker.com
Content-Type: application/x-www-form-urlencoded

action=transfer&amount=1000&to=attacker

HTTP/1.1 308 Permanent Redirect
Location: https://vulnerable.com/api/transfer

3. Exploiting Subdomain Takeovers

If you can control a subdomain of the target site, cookies may be sent to it:

// If vulnerable.com sets cookies for *.vulnerable.com
document.cookie = "malicious=payload; domain=.vulnerable.com";

4. Browser Flaws and Inconsistencies

Some browsers may not properly enforce SameSite rules in certain scenarios:

• Older browser versions
• Non-standard port numbers
• IP addresses instead of domains

Testing Methodology

1. Identify sensitive actions (password change, funds transfer)
2. Check if SameSite protection is implemented
3. Test with various HTTP methods (GET, POST, PUT)
4. Try different content types (form, JSON, XML)
5. Experiment with redirect chains

Mitigation Techniques

Conclusion

While SameSite cookies provide significant protection against CSRF, they are not foolproof. Understanding these bypass techniques is essential for both attackers and defenders.

Further Resources

• OWASP CSRF Guide
• SameSite Cookies Explained
• PortSwigger CSRF Academy