Lab: CSRF where Referer validation depends on header being present
Summary: PortSwigger's lab demonstrates a CSRF flaw in an email change function that tries to block cross-domain requests but falls back to an insecure mode when the Referer header is absent. The exercise asks the tester to host an HTML page on the exploit server that suppresses the Referer header and changes the viewer's email address, using the account wiener:peter.
Why it matters: A Referer check that only runs when the header is present is no check at all - an attacker who simply omits the header walks straight through, and the consequence here is a silent change to the victim's account email.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026