# CSRF possible when SOP Bypass/UXSS is available 

HackerOne CSRF tokens were printed in HTML and not bound per-action, so a UXSS/SOP-bypass could read the token and forge PATCH/DELETE requests.

- Payout: $2,500
- Severity: medium
- Program: HackerOne
- Credited: avlidienbrunn
- Disclosed: 2015-12-30
- CVE: CVE-2015-3115
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/103787
- Library page: https://bugbountylibrary.com/r/h1%3A103787
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:cdn technique:chained vuln:csrf vuln:xs-leak

**Target:** Web application CSRF token handling (settings/profile edit)
**Root cause:** CSRF tokens were embedded in HTML responses and shared across actions, so any content-read primitive (UXSS/SOP bypass) could extract a valid token and replay it against state-changing endpoints.
**Steps:**
1. Confirm token appears in HTML at `https://hackerone.com/settings/profile/edit`
2. Note same token accepted for multiple actions and `_method=PATCH/DELETE` overrides
3. Bypass X-Frame-Options by framing `https://hackerone.com/cdn-cgi/trace` (CloudFlare, no XFO)
4. Use IE UXSS to run script in framed origin, AJAX-fetch the edit page, extract token
5. Submit forged PATCH/DELETE with extracted token from attacker page
**How found:** Reasoned that CSRF protection depends on token secrecy, then observed tokens are rendered in HTML and reused across actions; searched for content-read primitives (SOP bypass, UXSS) and found CloudFlare's `/cdn-cgi/trace` lacks X-Frame-Options, enabling framing.
**Exploitation:** Victim logged into HackerOne visits attacker page in IE vulnerable to UXSS; script executes in the framed cdn-cgi/trace origin, reads the CSRF token via AJAX from the profile edit page, then issues state-changing requests with `_method` override. Origin header check fails to protect since Firefox/IE omit Origin on form submissions.
**Insight:** CSRF tokens embedded in HTML are only as strong as the app's content-confidentiality; check whether any same-origin endpoint (e.g. CDN paths like `/cdn-cgi/trace`) lacks X-Frame-Options, giving a frameable origin for UXSS/SOP-bypass chains.