hunt-csrf

Map all state-changing endpoints, check session cookies for missing SameSite attributes, then test CSRF token omission and cross-session token reuse. If the server accepts requests without a valid token, build a form-POST PoC page to confirm the vulnerability.

Submit the request with enctype text/plain using crafted form input names that produce valid JSON when serialized. Browsers treat text/plain as a simple request, so no CORS preflight occurs and cookies are attached cross-origin.

No. Top-level GET navigation still carries Lax cookies, so GET-triggered state changes remain exploitable. Sibling subdomains sharing a parent domain can also bypass Lax protections, as demonstrated in the Argo CD CVE-2024-22424 case.

Severity depends on chaining CSRF to concrete account-level impact such as account takeover via social account linking, email change, or OAuth token association. CSRF on logout or low-impact actions without state-change consequences is typically rejected as not applicable.

The OAuth state and SAML RelayState parameters function as CSRF tokens for authentication flows. When not cryptographically bound to the user's session, attackers can complete account-linking flows on a victim's session, associating attacker-controlled identities for account takeover.

Yes. Browsers cannot send custom headers on WebSocket upgrades, so CSRF token headers cannot be enforced. Endpoints relying only on session cookies are vulnerable to cross-site WebSocket hijacking, where a malicious page opens a socket with the victim's ambient credentials.