Lab: CSRF with broken Referer validation
Summary: PortSwigger's lab presents an email-change function that is vulnerable to CSRF and tries to block cross-domain requests, but its detection mechanism can be bypassed. The bypass works by appending the lab instance's domain to the Referer header as a query string, using history.pushState() and a referrer-policy header in the exploit server's Head section to stop browsers from stripping the query string.
What's compelling: A Referer check that only looks for the target domain anywhere in the header accepts a forged request, so an attacker-hosted page can change a victim's email address and take over the account.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026