Collected research

The Case of the Unconventional CSRF Attack in Firefox

The Case of an Unconventional CSRF Attack in Firefox

Kuskos · WhiteHat Security

Firefox 21 and earlier ignored the XHR rule that a HEAD request must have its body set to null, so send(data) after open("HEAD") still transmitted the body cross-origin with cookies attached. Against an application that accepts verb tampering this yields a CSRF that POST-shaped defences never see. Fixed in Firefox 22 as CVE-2013-1692.

Record

Document

The Case of an Unconventional CSRF Attack in Firefox

Researcher

Kuskos

Published by

WhiteHat Security

Topic

Browser

In the archive

• Collected in the 2013 research round

Tags

• csrf
• http
• javascript
• cve
• vendor-advisory
• cookie
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Kuskos, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.