CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.4)  

CWE-352: Cross-Site Request Forgery (CSRF)

Individual Definition in a New Window
Cross-Site Request Forgery (CSRF)
Status: Draft
Compound Element ID: 352 (Compound Element Variant: Composite)
+ Description
Summary

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Extended Description

When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in data disclosure or unintended code execution.

+ Alternate Terms
Session Riding
Cross Site Reference Forgery
XSRF
+ Time of Introduction
* Architecture and Design
* Implementation
+ Applicable Platforms
Languages
All
Technology Classes
Web-Server
+ Likelihood of Exploit

High

+ Demonstrative Examples

This example PHP code attempts to secure the form submission process by validating that the user submitting the form has a valid session. A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists.

The following HTML is intended to allow a user to update a profile.

HTML Example:
<form action="/url/profile.php" method="post">
<input type="text" name="firstname"/>
<input type="text" name="lastname"/>
<br/>
input type="text" name="email"/>
<input type="submit" name="submit" value="Update" />
</form>

profile.php contains the following code.

// initiate the session in order to validate sessions
 
session_start();
 
//if the session is registered to a valid user then allow update
 
if (! session_is_registered("username")) {
 
echo "invalid session detected!";
 
// Redirect user to login page
[...]
 
exit;
}
 
// The user session is valid, so process the request
// and update the information
 
update_profile();
 
function update_profile {
// read in the data from $POST and send an update
// to the database
SendUpdateToDatabase($_SESSION['username'], $_POST['email']);
[...]
echo "Your profile has been successfully updated.";
}

This code may look protected since it checks for a valid session. However, CSRF attacks can be staged from virtually any tag or HTML construct, including image tags, links, embed or object tags, or other attributes that load background images.

The attacker can then host code that will silently change the username and email address of any user that visits the page while remaining logged in to the target web application. The code might be an innocent-looking web page such as:

HTML Example:
<SCRIPT>
function SendAttack () {
form.email = "attacker@example.com";
// send to profile.php
form.submit();
}
</SCRIPT>
 
<BODY onload="javascript:SendAttack();">
 
<form action="http://victim.example.com/profile.php" id="form" method="post">
<input type="hidden" name="firstname" value="Funny">
<input type="hidden" name="lastname" value="Joke">
<br/>
<input type="hidden" name="email">
</form>

Notice how the form contains hidden fields, so when it is loaded into the browser, the user will not notice it. Because SendAttack() is defined in the body's onload attribute, it will be automatically called when the victim loads the web page.

Assuming that the user is already logged in to victim.example.com, profile.php will see that a valid user session has been established, then update the email address to the attacker's own address. At this stage, the user's identity has been compromised, and messages sent through this profile could be sent to the attacker's address.

+ Observed Examples
ReferenceDescription
Add user accounts via a URL in an img tag
Gain administrative privileges via a URL in an img tag
Arbitrary code execution by specifying the code in a crafted img tag or URL
Add user accounts via a URL in an img tag
Perform actions as administrator via a URL or an img tag
Delete a victim's information via a URL or an img tag
Change another users settings via a URL or an img tag
+ Potential Mitigations
Architecture and Design

Use anti-CSRF packages such as the OWASP CSRFGuard.

Implementation

Ensure that your application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).

Note that this can be bypassed using XSS (CWE-79).

Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Note that this can be bypassed using XSS (CWE-79).

Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller.

Note that this can probably be bypassed using XSS (CWE-79).

Architecture and Design

Use the ESAPI Session Management control.

This control includes a component for CSRF.

Architecture and Design

Do not use the GET method for any request that triggers a state change.

Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Note that this can be bypassed using XSS (CWE-79). An attacker could use XSS to generate a spoofed Referer, or to generate a malicious request from a page whose Referer would be allowed.

Testing

Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.

Use OWASP CSRFTester to identify potential issues.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class345Insufficient Verification of Data Authenticity
Development Concepts (primary)699
Research Concepts (primary)1000
RequiresWeakness BaseWeakness BaseWeakness Base346Origin Validation Error
Research Concepts1000
RequiresWeakness BaseWeakness BaseWeakness Base441Unintended Proxy/Intermediary
Research Concepts1000
RequiresWeakness ClassWeakness ClassWeakness Class642External Control of Critical State Data
Research Concepts1000
RequiresWeakness BaseWeakness BaseWeakness Base613Insufficient Session Expiration
Research Concepts1000
ChildOfCategoryCategory716OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)
Weaknesses in OWASP Top Ten (2007) (primary)629
ChildOfCategoryCategory751Insecure Interaction Between Components
Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750
MemberOfViewView635Weaknesses Used by NVD
Weaknesses Used by NVD (primary)635
PeerOfWeakness BaseWeakness BaseWeakness Base79Failure to Preserve Web Page Structure ('Cross-site Scripting')
Research Concepts1000
+ Relationship Notes

This can be resultant from XSS, although XSS is not necessarily required.

+ Research Gaps

This issue was under-reported in CVE until around 2008, when it began to gain prominence. It is likely to be present in most web applications.

+ Theoretical Notes

The CSRF topology is multi-channel:

1. Attacker (as outsider) to intermediary (as user). The interaction point is either an external or internal channel.

2. Intermediary (as user) to server (as victim). The activation point is an internal channel.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVER  Cross-Site Request Forgery (CSRF)
OWASP Top Ten 2007A5ExactCross Site Request Forgery (CSRF)
+ References
Peter W. "Cross-Site Request Forgeries (Re: The Dangers of Allowing Users to Post Images)". Bugtraq. <http://marc.info/?l=bugtraq&m=99263135911884&w=2>.
Edward W. Felten and William Zeller. "Cross-Site Request Forgeries: Exploitation and Prevention". 2008-10-18. <http://freedom-to-tinker.com/sites/default/files/csrf.pdf>.
Robert Auger. "CSRF - The Cross-Site Request Forgery (CSRF/XSRF) FAQ". <http://www.cgisecurity.com/articles/csrf-faq.shtml>.
"Cross-site request forgery". Wikipedia. 2008-12-22. <http://en.wikipedia.org/wiki/Cross-site_request_forgery>.
+ Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Alternate_Terms, Description, Relationships, Other_Notes, Relationship_Notes, Taxonomy_Mappings
CWE Content Team. MITRE. 2009-01-12. (Internal)
updated Applicable_Platforms, Description, Likelihood_of_Exploit, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationship_Notes, Relationships, Research_Gaps, Theoretical_Notes
CWE Content Team. MITRE. 2009-03-10. (Internal)
updated Potential_Mitigations
Tom Stracener. 2009-05-20. (External)
Added demonstrative example for profile.
CWE Content Team. MITRE. 2009-05-27. (Internal)
updated Demonstrative_Examples, Related_Attack_Patterns
Page Last Updated: May 26, 2009