Attacking Sites Using CSRF

From CSRF to user information leak, XSS and full account takeover.

CSRF and turf. (Photo by Chensiyuan on Wikimedia Commons.)

The criticality of a CSRF vulnerability depends heavily on where the vulnerability is located. Sometimes, faulty CSRF protection mechanisms lead to inconsequential issues like unauthorized setting changes or emptying a user’s cart. Other times, they lead to much bigger issues: user information leak, XSS and…