# Bug Bounty - Cross-site request forgery is a thing

Admin ticket-limit app lacked CSRF tokens; a one-click page chained four POSTs to create an airline, email, and mail out credentials and secret, granting app access.

- Payout: $2,400
- Severity: high
- Program: -
- Credited: Patrick Hener
- Disclosed: 2022-09-12
- Write-up quality: 6/10
- Original: https://hesec.de/posts/bbh-csrf/
- Library page: https://bugbountylibrary.com/r/blog%3Ahesec-de-posts-bbh-csrf
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:blog sev:high tech:java technique:chained vuln:csrf vuln:xss

**Target:** Java web app /tlm/emailFunction.form admin actions
**Root cause:** State-changing POST endpoints under /tlm/emailFunction.form accepted requests without any anti-CSRF token or Origin/Referer validation.
**Steps:**
1. Observe all form POSTs in Burp history lack CSRF tokens
2. Host attacker page with four auto-submitting hidden forms targeting hidden iframes
3. Form1: `action=addairlinedetails&airline=` with `txtAirline=SY`, `txtLoginName=C1SC0`, `selUsrType=supervisor`
4. Form2: `action=addemaildetails` with `txtEmailAddr=<attacker email>`, `selKeyGen=1`
5. Form3: `action=genPwd` for airline SY, login C1SC0
6. Form4: `action=genSecret` for same airline/login
7. Victim (admin) visits page; app emails password and secret to attacker address
8. Attacker logs in with received password + secret
**How found:** Skimming Burp request history, noticed no POST form submissions carried anti-CSRF tokens; focused on the highest-impact admin action at /tlm/emailFunction.form.
**Exploitation:** Attacker lures authenticated admin to malicious page; four chained CSRF POSTs create an airline and email, then trigger genPwd and genSecret which email credentials and login secret to the attacker-controlled address, enabling login as a regular user.
**Escalation:** Chained four low-impact CSRF actions into full application access; bonus chain added stored XSS via email field (blocked from ATO by httpOnly cookie).
**Insight:** When auditing admin panels, enumerate every action parameter on a single form endpoint (e.g. `?action=`) — one unprotected handler often multiplexes many privileged operations that can be chained into credential exfiltration.