A attack using SSRF to obtain CSRF

Process

  1. Some subdomain b.site.com allows SSRF
  2. Some subdomain a.site.com allows CORS to enable localhost, protected against CSRF
  3. Launch SSRF against b.site.com from a.site.com