868
CWE-352: Cross-Site Request Forgery (CSRF)
Weakness ID : 352
Structure : Composite
Abstraction : Compound
Description
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent
request was intentionally provided by the user who submitted the request.
Composite Components
Nature Type ID Name Page
Requires 346 Origin Validation Error 853
Requires 441 Unintended Proxy or Intermediary ('Confused Deputy') 1064
Requires 642 External Control of Critical State Data 1414
Requires 613 Insufficient Session Expiration 1371
Extended Description
When a web server is designed to receive a request from a client without any mechanism for
verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into
making an unintentional request to the web server which will be treated as an authentic request.
This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data
or unintended code execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
PeerOf 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')