Cross-site request forgery attack

By
Rejah Rehim
Published on
24 Jun 2022
2 min read
CSRF

Cross-Site Request Forgery (CSRF) that is also known as XSRF that refers to an attack which leads to the user to execute unwanted actions to the web application where they have access to it. Usually, it will look like a regular link to the web application. But the parameter will be manipulated it will make the HTTP request to the web application as attacker intended. It used to make state-changing requests such as to change the password, make account transactions. The social engineering method is used to influence the user to execute as attackers choosing. It may come as mail or a chat. As of the privilege increases the chance of compromising the application is high. If the victim is a standard user account, it will use for changing mail id password or even transfer fund. In case of the Administrator account; it will compromise the whole application.

Example

Cross-site Request Forgery (CSRF) in GET requests

Given below is an example of how the Cross-site Request Forgery (CSRF) can be used to abuse the user in GET request using the < img> tag.

GET

        <a href="https://example.beaglesecurity.com/newPassword.php/?password=attacker">You won a prize click here to claim</a>

    

The attacker can generate a custom attribute like the above example and include it in the website that was controlled by the attacker. When the user opens the malicious site, it will use the HTTP GET request to perform the password change while it was logged in. The user won’t notify the password change.

Cross-site Request Forgery in POST requests

If the application only works through the POST request. Well, the attacker can even use the POST request to abuse the user. All of the banking and sensitive information also gone through the POST request. All that the attacker needs to do is make a JavaScript to submit the post request.

        <iframe src="https://example.beaglesecurity.com/ClaimPrize" style="width:0;height:0;border:0;border:none;"></iframe>
        iframe contents
        <body onload="document.getElementById('csrf').submit()">
        <form id="csrf" action="https://example.beaglesecurity.com/sendmoney" method="POST">
        <input name="amount" value="10000" />
        </form>
        </body>

    

Impact

The impact include:-

  • Attackers might get full access to the application
  • Loss of trust from the user.

Mitigation / Precaution

Beagle recommends the following fixes:-

  • Use Anti-CSRF tokens
  • Implement Same-site Cookies
Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Rejah Rehim
Rejah Rehim
Co-founder, Director
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment
Experience the power of automated penetration testing & contextual reporting.