Cross Site Request Forgery (CSRF/XSRF)

Description

Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into loading a page that contains a malicious request. It is malicious in the sense that it inherits the identity and privileges of the victim to perform an undesired function on the victim’s behalf, like change the victim’s e-mail address, home address, or password, or purchase something. CSRF attacks generally target functions that cause a state change on the server but can also be used to access sensitive data.

Browsers usually automatically include with such requests any credentials associated with the site, such as the user’s session cookie, basic auth credentials, IP address, Windows domain credentials, etc. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish this from a legitimate user request.

An attacker can make the victim perform actions that they didn’t intend to, such as logout, purchase item, change account information, retrieve account information, or any other function provided by the vulnerable website.

See How to Fix it!

Risk

A successful CSRF attack can lead to:

• Gaining privileges
• Bypassing protection mechanism
• Reading application data
• Modifying application data

How to Prevent CSRF

Prevent CSRF in ASP.NET
Prevent CSRF in JAVA
Prevent CSRF in PHP

References

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
http://en.wikipedia.org/wiki/Cross-site_request_forgery
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet