Collected research

CSRF Protection Bypass in Play Framework

Kevin Joensen and Luca Carettoni · Doyensec

Demonstrates a CSRF bypass caused by disagreement between browsers, Akka HTTP and Play Framework over a multipart boundary containing an extra semicolon. Akka drops the content type, allowing Play's legacy blacklist-based CSRF filter to accept the request.

Record

Researcher

Kevin Joensen and Luca Carettoni

Published by

Doyensec

In the archive

• Collected in the 2020 research round

Tags

• csrf
• parser-differential
• filter-bypass
• http
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Kevin Joensen and Luca Carettoni, first published at the original source. Preserved copies are kept so the citation survives its host.