869
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Non-Repudiation
Access Control
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Read Application Data
Modify Application Data
DoS: Crash, Exit, or Restart
The consequences will vary depending on the nature of
the functionality that is vulnerable to CSRF. An attacker
could effectively perform any operations as the victim.
If the victim is an administrator or privileged user, the
consequences may include obtaining complete control
over the web application - deleting or stealing data,
uninstalling the product, or using it to launch other attacks
against all of the product's users. Because the attacker has
the identity of the victim, the scope of CSRF is limited only
by the victim's privileges.
Detection Methods
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human)
analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester
to record and modify an active session. Specifically, manual analysis can be useful for finding
this weakness, and for minimizing false positives assuming an understanding of business
logic. However, it might not achieve desired code coverage within limited time constraints. For
black-box analysis, if credentials are not known for privileged accounts, then the most securitycritical
portions of the application may not receive sufficient attention. Consider using OWASP
CSRFTester to identify potential issues and aid in manual analysis.
Effectiveness = High
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Automated Static Analysis
CSRF is currently difficult to detect reliably using automated techniques. This is because each
application has its own implicit security policy that dictates which requests can be influenced
by an outsider and automatically performed on behalf of a user, versus which requests require
strong confidence that the user intends to make the request. For example, a keyword search
of the public portion of a web site is typically expected to be encoded within a link that can be
launched automatically when the user clicks on the link.
Effectiveness = Limited
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
CWE Version 4.14
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-352: Cross-Site Request Forgery (CSRF)