Cross-Site Request Forgery (CSRF) Detection

ALTERNATIVE NAMES

XSRF, “Sea Surf”, Session Riding, Cross-Site Reference Forgery, Hostile Linking, and One-Click Attack.

SEVERITY

HIGH

AFFECTED SYSTEMS

Cross-Site Request Forgery (CSRF) is a vulnerability that occurs in websites with weakly designed session handling.

DESCRIPTION

Using this vulnerability, an attacker may use an external site to push information to your website. If the login session is present on the site and if any information can be sent to the site via external pages with GET or PUT methods, any attacker filling the appropriate form fields may forward the customer to any desired situation.

SOLUTION

Only use POST requests on your site and check the origin of the POSTs
Use a secret token in the forms passing through all transactions and POST it to every new page through the session

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.