CSRF & CORS Misconfiguration

Exploitation MED v1.0.0 updated 2026-06-17

Test for cross-site request forgery, CORS misconfigurations, and cross-origin data leakage across all state-changing and authenticated endpoints.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/csrf-cors-testing

// checklist steps

csrf-01

Identify state-changing endpoints

Map all endpoints that perform state-changing operations (password change, email update, fund transfer, settings modification) and note their HTTP method and authentication mechanism.

cat all-urls.txt | grep -iE '(update|delete|change|transfer|modify|create|add|remove|edit|settings)'
nuclei -l live-hosts.txt -t misconfiguration/ -t vulnerabilities/csrf/ -o csrf-scan.txt

Focus on endpoints that use cookie-based authentication — API endpoints using Bearer tokens in the Authorization header are not vulnerable to traditional CSRF.

csrf-02

Test CSRF token validation

Test whether CSRF tokens are properly validated by removing the token, submitting an empty token, reusing tokens across sessions, and swapping tokens between users.

# Remove CSRF token entirely
curl -sk -X POST https://target.com/api/change-email -H 'Cookie: session=<session>' -d 'email=attacker@evil.com'
# Submit empty token
curl -sk -X POST https://target.com/api/change-email -H 'Cookie: session=<session>' -d 'email=attacker@evil.com&csrf_token='

Some implementations only check that a token is present but do not validate its value. Test with random strings as well.

csrf-03

Test CORS configuration

Send cross-origin requests with various Origin headers to identify reflection, null origin acceptance, wildcard credentials, and subdomain trust issues.

curl -sk -I https://target.com/api/user -H 'Origin: https://evil.com'
curl -sk -I https://target.com/api/user -H 'Origin: null'
curl -sk -I https://target.com/api/user -H 'Origin: https://sub.target.com'
curl -sk -I https://target.com/api/user -H 'Origin: https://target.com.evil.com'

Check both Access-Control-Allow-Origin and Access-Control-Allow-Credentials in responses. Origin reflection with credentials is the most critical finding.

csrf-04

Test SameSite cookie attribute

Verify that session cookies use the SameSite attribute and test whether the browser enforces it for cross-site POST and GET requests.

curl -sk -I https://target.com/login -c - | grep -i 'set-cookie'

Cookies without SameSite default to Lax in modern browsers, which blocks cross-site POST but allows top-level GET navigations. SameSite=None requires the Secure flag.

csrf-05

Test content-type based CSRF bypass

Attempt to bypass CSRF protection by changing the Content-Type header to text/plain, application/x-www-form-urlencoded, or multipart/form-data, which do not trigger CORS preflight.

curl -sk -X POST https://target.com/api/update -H 'Content-Type: text/plain' -d '{"email":"attacker@evil.com"}'
curl -sk -X POST https://target.com/api/update -H 'Content-Type: application/x-www-form-urlencoded' -d 'email=attacker@evil.com'

JSON endpoints that do not enforce Content-Type validation can be attacked via HTML forms using enctype=text/plain.

csrf-06

Test cross-origin data leakage

Check whether sensitive data is exposed through JSONP endpoints, CORS-enabled APIs, or postMessage handlers without proper origin validation.

curl -sk 'https://target.com/api/user?callback=leak'
nuclei -u https://target.com -t exposures/apis/ -t misconfiguration/cors/ -o cors-findings.txt

JSONP endpoints that return user data are equivalent to a CORS misconfiguration. Also check for postMessage handlers in JavaScript files that do not verify event.origin.

Overview

CSRF and CORS misconfigurations allow an attacker to perform actions or read data on behalf of an authenticated user from a malicious website. While modern browser defaults (SameSite=Lax) have reduced the attack surface, many applications still rely on custom CSRF tokens or misconfigure CORS policies.

Quick win checks

Missing CSRF tokens on state-changing POST requests
Origin header reflected verbatim in Access-Control-Allow-Origin
Access-Control-Allow-Credentials: true with a reflected origin
JSONP endpoints that return authenticated user data

SameSite vs CSRF tokens

SameSite cookies are a defence-in-depth measure, not a replacement for CSRF tokens. Some attack scenarios — such as subdomain takeover combined with SameSite=None — can bypass cookie-level protections entirely.

// references

← All checklists JSON ↗