POST-to-GET interchange found on 407 of Tranco top 10k
Original title: When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications
Some equivalent GETs accept CSRF tokens rejected on POST and return cacheable responses.
Researchers introduce MIDE, which rewrites captured POST requests as GETs and compares responses against a no-query baseline. On the Tranco top 10,000, high-confidence interchange appeared on 407 sites, or 4.1%. A targeted check found invalid CSRF tokens rejected for POST but accepted for the equivalent GET. They also observed web cache deception conditions and cacheable GET responses.
Unconfirmed: The paper reports observable defense gaps, not confirmed exploitation by attackers.
- Interchange appeared on 407 of 3,200 sites with captured POSTs, or 12.7%.
- It appeared on 407 of 2,734 sites with replayed POSTs, or 14.9%.
- Only GET matches that fail the no-query baseline count as high confidence.
- The crawl was unauthenticated.
Impact: CSRF checks bypassed and cacheable responses via GET
From the original article
1 min read at arxiv.orgHTTP method semantics are a common boundary between safe retrieval and state-changing operations; however, deployed web applications do not always enforce this boundary consistently.
By Matteo Golinelli · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.