The SameSite security property is a known mitigation against Cross-Site Request Forgery (CSRF) attacks. However, a recently patched bug in Android allows malicious actors to bypass the SameSite feature by redirecting to intent. This proof of concept was tested SameSite cookie bypass on two popular browsers - Chrome and Firefox on a Google Pixel 6 pro device.

Set up for this attack

To set the SameSite cookie, we leveraged our in-house implementation of the httpbin.org service to inspect the HTTP request. One can perform the same steps using httpbin.org as follows:

• Set up the SameSite cookie:
https://httpbin.org/response-headers?set-cookie=certuscyber=poc;SameSite=Strict
• To verify that headers are leveraged, go to
 https://httpbin.org/headers 
You might notice that the SameSite=Strict setting is not configured.
• Now that the HTTP request is set up, to create the PoC, we started a ‘/poc’ path on our website: https://www.certuscyber.com.
• On the mobile browser (we checked the user agent), /poc would redirect by adding the following header:
  
Location: intent://httpbin.org/headers#Intent;scheme=https;package=com.android.chrome;end
• Using the Chrome browser, when we type https://www.certuscyber.com/poc, we are redirected and can see the header information from httpbin.org.
• Keep in mind that SameSite was set to Strict. However, since we used Intent, we successfully bypassed the SameSite restriction.

Security mitigations

On the Chrome web browser, there is an experimental cookie feature flag. For more information about this cookie feature, visit: chrome://flags/#enable-experimental-cookie-features. This experimental cookie would restore the secure behavior and prevent SameSite cookies, but it does not work against an intent redirect.

To mitigate this attack, one must avoid using Intent URLs/redirects to reflect back to Chrome and potentially uses them to bypass the SameSite restrictions.

About the Author

Swapnil Deshmukh is CTO & co-founder of Certus Cybersecurity. A product security thought leader and subject matter expert, Swapnil is responsible for leading the company's global team of security engineers.