Author: KirstenS Show
OverviewCross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. How to Review Code for CSRF VulnerabilitiesSee the OWASP Code Review Guide article on how to review code for CSRF vulnerabilities. How to Test for CSRF VulnerabilitiesSee the OWASP Testing Guide article on how to test for CSRF vulnerabilities. How to Prevent CSRF VulnerabilitiesSee the CSRF Prevention Cheat Sheet for prevention measures. Listen to the OWASP Top Ten CSRF Podcast. Most frameworks have built-in CSRF support such as Joomla, Spring, Struts, Ruby on Rails, .NET and others. Use OWASP CSRF Guard to add CSRF protection to your Java applications. You can use CSRFProtector Project to protect your PHP applications or any project deployed using Apache Server. John Melton also has an excellent blog post describing how to use the native anti-CSRF functionality of the OWASP ESAPI. DescriptionCSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim’s behalf (though note that this is not true of login CSRF, a special form of the attack described below). For most sites, browser requests automatically include any credentials associated with the site, such as the user’s session cookie, IP address, Windows domain credentials, and so forth. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish between the forged request sent by the victim and a legitimate request sent by the victim. CSRF attacks target functionality that causes a state change on the server, such as changing the victim’s email address or password, or purchasing something. Forcing the victim to retrieve data doesn’t benefit an attacker because the attacker doesn’t receive the response, the victim does. As such, CSRF attacks target state-changing requests. An attacker can use CSRF to obtain the victim’s private data via a special form of the attack, known as login CSRF. The attacker forces a non-authenticated user to log in to an account the attacker controls. If the victim does not realize this, they may add personal data—such as credit card information—to the account. The attacker can then log back into the account to view this data, along with the victim’s activity history on the web application. It’s sometimes possible to store the CSRF attack on the vulnerable site itself. Such vulnerabilities are called “stored CSRF flaws”. This can be accomplished by simply storing an IMG or IFRAME tag in a field that accepts HTML, or by a more complex cross-site scripting attack. If the attack can store a CSRF attack in the site, the severity of the attack is amplified. In particular, the likelihood is increased because the victim is more likely to view the page containing the attack than some random page on the Internet. The likelihood is also increased because the victim is sure to be authenticated to the site already. SynonymsCSRF attacks are also known by a number of other names, including XSRF, “Sea Surf”, Session Riding, Cross-Site Reference Forgery, and Hostile Linking. Microsoft refers to this type of attack as a One-Click attack in their threat modeling process and many places in their online documentation. Prevention measures that do NOT workA number of flawed ideas for defending against CSRF attacks have been developed over time. Here are a few that we recommend you avoid. Using a secret cookieRemember that all cookies, even the secret ones, will be submitted with every request. All authentication tokens will be submitted regardless of whether or not the end-user was tricked into submitting the request. Furthermore, session identifiers are simply used by the application container to associate the request with a specific session object. The session identifier does not verify that the end-user intended to submit the request. Only accepting POST requestsApplications can be developed to only accept POST requests for the execution of business logic. The misconception is that since the attacker cannot construct a malicious link, a CSRF attack cannot be executed. Unfortunately, this logic is incorrect. There are numerous methods in which an attacker can trick a victim into submitting a forged POST request, such as a simple form hosted in an attacker’s Website with hidden values. This form can be triggered automatically by JavaScript or can be triggered by the victim who thinks the form will do something else. Multi-Step TransactionsMulti-Step transactions are not an adequate prevention of CSRF. As long as an attacker can predict or deduce each step of the completed transaction, then CSRF is possible. URL RewritingThis might be seen as a useful CSRF prevention technique as the attacker cannot guess the victim’s session ID. However, the user’s session ID is exposed in the URL. We don’t recommend fixing one security flaw by introducing another. HTTPSHTTPS by itself does nothing to defend against CSRF. However, HTTPS should be considered a prerequisite for any preventative measures to be trustworthy. ExamplesHow does the attack work?There are numerous ways in which an end user can be tricked into loading information from or submitting information to a web application. In order to execute an attack, we must first understand how to generate a valid malicious request for our victim to execute. Let us consider the following example: Alice wishes to transfer $100 to Bob using the bank.com web application that is vulnerable to CSRF. Maria, an attacker, wants to trick Alice into sending the money to Maria instead. The attack will comprise the following steps:
GET scenarioIf the application was designed to primarily use GET requests to transfer parameters and execute actions, the money transfer operation might be reduced to a request like: GET http://bank.com/transfer.do?acct=BOB&amount=100 HTTP/1.1 Maria now decides to exploit this web application vulnerability using Alice as the victim. Maria first constructs the following exploit URL which will transfer $100,000 from Alice’s account to Maria’s account. Maria takes the original command URL and replaces the beneficiary name with herself, raising the transfer amount significantly at the same time: http://bank.com/transfer.do?acct=MARIA&amount=100000 The social engineering aspect of the attack tricks Alice into loading this URL when Alice is logged into the bank application. This is usually done with one of the following techniques:
The exploit URL can be disguised as an ordinary link, encouraging the victim to click it: <a href="http://bank.com/transfer.do?acct=MARIA&amount=100000">View my Pictures!</a> Or as a 0x0 fake image: <img src="http://bank.com/transfer.do?acct=MARIA&amount=100000" width="0" height="0" border="0"> If this image tag were included in the email, Alice wouldn’t see anything. However, the browser will still submit the request to bank.com without any visual indication that the transfer has taken place. A real life example of CSRF attack on an application using GET was a uTorrent exploit from 2008 that was used on a mass scale to download malware. POST scenarioThe only difference between GET and POST attacks is how the attack is being executed by the victim. Let’s assume the bank now uses POST and the vulnerable request looks like this: POST http://bank.com/transfer.do HTTP/1.1 acct=BOB&amount=100 Such a request cannot be delivered using standard A or IMG tags, but can be delivered using a FORM tags: <form action="http://bank.com/transfer.do" method="POST"> <input type="hidden" name="acct" value="MARIA"/> <input type="hidden" name="amount" value="100000"/> <input type="submit" value="View my pictures"/> </form> This form will require the user to click on the submit button, but this can be also executed automatically using JavaScript: <body onload="document.forms[0].submit()"> <form... Other HTTP methodsModern web application APIs frequently use other HTTP methods, such as PUT or DELETE. Let’s assume the vulnerable bank uses PUT that takes a JSON block as an argument: PUT http://bank.com/transfer.do HTTP/1.1 { "acct":"BOB", "amount":100 } Such requests can be executed with JavaScript embedded into an exploit page: <script> function put() { var x = new XMLHttpRequest(); x.open("PUT","http://bank.com/transfer.do",true); x.setRequestHeader("Content-Type", "application/json"); x.send(JSON.stringify({"acct":"BOB", "amount":100})); } </script> <body onload="put()"> Fortunately, this request will not be executed by modern web browsers thanks to same-origin policy restrictions. This restriction is enabled by default unless the target web site explicitly opens up cross-origin requests from the attacker’s (or everyone’s) origin by using CORS with the following header: Access-Control-Allow-Origin: *
References
What type of attack does the attacker infect a website that is often visited by the target users?A watering hole attack is a security exploit in which the attacker seeks to compromise a specific group of end users by infecting websites that members of the group are known to visit. The goal is to infect a targeted user's computer and gain access to the network at the target's workplace.
Which type of attack can be used to intercept and alter data that is sent between hosts?Which of the following attacks relies on intercepting and altering data sent between two networked hosts? Cross-site request forgery (CSRF/XSRF) is a security exploit that allows for infecting a website with malicious code.
Which type of attack uses more than one computer to attack the victim DoS DDoS social engineering brute force?As opposed to the simple Denial of Service (DoS) attacks that usually are performed from a single system, a Distributed Denial of Service (DDoS) attack uses multiple compromised computer systems to perform the attack against its target.
In which type of attack is malicious code injected into a trusted Web site?Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
|