Understanding Cross-Site Request Forgery (CSRF)

Study Notes

What is CSRF?

Cross-site request forgery (CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions they do not intend to perform.
CSRF allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.

Impact of CSRF Attack

In a successful CSRF attack, the attacker causes the victim user to carry out an action unintentionally.
Examples of unintended actions include changing the email address on their account, changing their password, or making a funds transfer.
Depending on the nature of the action, the attacker might gain full control over the user's account.
If the compromised user has a privileged role within the application, the attacker might gain full control of all the application's data and functionality.

How CSRF Works

Three key conditions must be in place for a CSRF attack to be possible:
The attacker can construct a web page containing malicious HTML to induce the victim to perform an unintended action.
If a victim user visits the attacker's web page, the malicious HTML is executed, and the unintended action is performed.

Constructing a CSRF Attack

Manually creating the HTML needed for a CSRF exploit can be cumbersome.
The easiest way to construct a CSRF exploit is using the CSRF PoC generator that is built into Burp Suite Professional.

Delivering a CSRF Exploit

The delivery mechanisms for CSRF attacks are essentially the same as for reflected XSS.
The attacker typically places the malicious HTML onto a website they control and induces victims to visit that website.
The attacker may also use a self-contained attack with a single URL on the vulnerable website, especially if the request can be performed with the GET method.

Defences against CSRF

Common defences against CSRF include:
Token-based mitigation
Cookie-to-header token
Referer header validation
Header-based validation
Double-submit cookie
Synchronizer token pattern
Encrypted token pattern
Custom headers

Description

Learn about the web security vulnerability of cross-site request forgery, including its definition, examples of common vulnerabilities, and prevention methods. Test your knowledge on CSRF and its impact on the same origin policy.