This time the vulnerability affected more than one website as the bugs were in django framework and in Google Analytics. It led to arbitrary cookie write and could result in complete bypassing double submit cookie CSRF prevention mechanism.

Original report:


Follow me on twitter:

00:00 Intro
00:21 Google Analytics
01:16 How do webservers handle cookies
02:46 Overriding cookie attributes
03:36 Double submit cookies
04:42 Putting it all together

#csrf #django

Add comment

Your email address will not be published. Required fields are marked *