870
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Web
Application Scanner
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Fuzz
Tester Framework-based Fuzzer
Effectiveness = High
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source
Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Source code Weakness Analyzer Context-configured Source Code Weakness
Analyzer
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code,
etc.) Formal Methods / Correct-By-Construction
Effectiveness = SOAR Partial
Potential Mitigations
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. For example, use anti-CSRF packages such
as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management
control, which includes a component for CSRF. [REF-45]
Phase: Implementation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF
defenses can be bypassed using attacker-controlled script.
Phase: Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon
receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Phase: Architecture and Design
Identify especially dangerous operations. When the user performs a dangerous operation, send a
separate confirmation request to ensure that the user intended to perform that operation.
Phase: Architecture and Design
Use the "double-submitted cookie" method as described by Felten and Zeller: When a user
visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's
machine. The site should require every form submission to include this value as a form value
CWE Version 4.14
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-352: Cross-Site Request Forgery (CSRF)