Cross-Site Request Forgery (CSRF)
Explore how Cross-Site Request Forgery (CSRF) attacks abuse the trust a site has in your browser.
Coreweb, authentication
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. It exploits the trust that a site has in a user's browser.
Impact of CSRF Attacks
- Unauthorized actions performed on behalf of authenticated users
- Potential for financial fraud in banking or e-commerce applications
- Data theft or manipulation
- Account takeover or privilege escalation
Common CSRF Attack Methods
- Crafting malicious URLs, images, or forms that trigger unwanted actions
- Exploiting predictable or guessable request parameters
- Using social engineering to trick users into clicking malicious links
- Leveraging XSS vulnerabilities to bypass CSRF protections
Preventing CSRF Attacks
- Implement anti-CSRF tokens in forms and AJAX requests
- Use the SameSite cookie attribute
- Verify the origin and referrer headers
- Implement proper session management
- Use custom request headers for AJAX calls
- Require re-authentication for sensitive actions
- Implement CSRF-specific security headers
Real-World CSRF Incidents
IHC Health Services CSRF Attack (2014)
A CSRF vulnerability in IHC Health Services' website allowed attackers to potentially access and modify patients' health information, highlighting the risks of CSRF in sensitive applications.
CSRF Attack Example
Here's an example of a simple CSRF attack payload:
<img src="http://bank.com/transfer?amount=1000&to=attacker" style="display:none" />
<form action="http://bank.com/transfer" method="POST">
<input type="hidden" name="amount" value="1000" />
<input type="hidden" name="to" value="attacker" />
</form>
<script>document.forms[0].submit();</script>
This example demonstrates:
- A hidden image that triggers a GET request
- A form that automatically submits a POST request
- Both methods attempt to transfer money to the attacker's account