Difference between revisions of "Reviewing code for Cross-Site Request Forgery issues"

Revision as of 09:34, 1 August 2007

Introduction

Cross-Site Request Forgery (CSRF) attacks are considered useful if the attacked knows the target is authenticated to a web based system. They dont work unless the target is logged into the system and therefore have a small attack footprint. In effect CSRF attacks are used by an attacker to make a target system perform a function via the targets browser without knowledge of the target user, at least until the unauthorised function has been comitted.

How they work:

See:

1. http://www.owasp.org/index.php/CSRF_Guard
2. http://www.owasp.org/index.php/Cross-Site_Request_Forgery

for a more detailed explaination but the main issue is the sending of a rogue HTTP request from an authenticated users browser to the application which shall commit a transaction without authorisation given by the target user. As long as the user is authenticated and a menaingful HTTP request is sent by the users browser to a target application the application does not know if origin of the request be it a valid transaction or a link clicked by the user (that was say, in an email) whilst the user is authenticated to the applications. So, as an example, using CSRF an attacker make the victim perform actions that they didn't intend to, such as logout, purchase item, change account information, or any other function provided by the vulnerable website.

How to locate the potentially vulnerable code

This issue is simple to detect but there may be compensating controls around the functionality of the application which may alert the user to a CSRF attempt. As long as the application accepts a well formed HTTP request and the request adheres to some business logic of the application CSRF shall work (From now on we assume the target user is logged into the system to be attacked).

By checking the page rendering we need to see if any unique identifiers are appended to the links rendered by the application in the users browser. (more on this later). If there is no unique identifier relating to each HTTP request to tie a HTTP request to the user we are vulnerable. Session ID is not enough as the session ID shall be sent anyway if a user clicks on a rogue link as the user is authenticated already.

Vulnerable Patterns for CSRF

Any application that accepts HTTP requests from an authenticated user without having some control to verify that the HTTP request is unique to the users session. (Nearly all web applications!!). Session ID is not in scope here as the rogue HTTP request shall also contain a valid session ID as the user is authenticated already.

Good Patterns & procedures to prevent CSRF

So checking the request has a valid session cookie is not enough, we need check that a unique identifier is sent with every HTTP request sent to the application. CSRF requests WON'T have this valid unique identifier.. The reason CSRF requests wont have this unique request identifer is the unique id is rendered as a hidden field on the page and is appended to the HTTP reuqest once a link/button press is selected. The attacker will have no knowledge of this unique id as it is random and rendered dynamically per link, per page.

1. A list is complied prior to delivering the page to the user. The list contains all valid unique Id's generated for all links on a given page. The unique Id could be derived from a secure random generator such as SecureRandom for J2EE.

1. A unique Id is appended to each link/form on the requested page prior to being displayed to the user.

1. Maintaining a list of unique id's in the user session, the application checks if the unique Id passed with the HTTP request is valid for a given request.

1. If the unique ID is not present terminate the user session, display an error to the user.

Related Articles

http://www.owasp.org/index.php/Cross-Site_Request_Forgery