Resources

Website Security Whitepaper

Cross Site Request Forgery (CSRF)

Download a Complimentary Copy of this Whitepaper ››

Cross-Site Request Forgeries (CSRF). Session Riding. Client-Side Trojans. Confused Deputy. Web Trojans. Confused? Every year, for the past several years, the exact same Web attack is discovered, analyzed, and subsequently renamed. Whatever it’s called, it all means the same thing: An attacker is forcing an unsuspecting user’s browser to send requests they didn’t intend and potentially compromising their own banking, e-commerce or other website accounts.

Attackers have begun to actively exploit CSRF vulnerabilities across the Web. Why now? Because it’s incredibly easy and the vast majority of websites are vulnerable to it. How do you stop an attack originating from a “real user,” who could be properly logged-in, from making a legitimate request - except the problem is they did not intend to make the request?

For those familiar with Cross-Site Scripting, Chris Shiflett (principal of OmniTI) said it best: “Cross-Site Request Forgeries are an almost opposite style of attack. Rather than exploiting the trust that a user has for a website, they (CSRF attacks) exploit the trust that a website has for a user.

Here’s an example of how a CSRF attack works:

Let’s say you’re logged-in to your online bank, which has a “Transfer Funds” feature. To transfer money from one account to another, you would fill out a Web-form similar to the one in Figure 1. After specifying the appropriate “From” account, “To” account, and dollar amount, you click the “Continue” button. For our purposes, let’s say the “From” account is “314159265,” the “To” account is “011235813,” and we’re transferring $5,000.

Figure 1: Transfer Funds Web-form:

About the Author ::
Jeremiah Grossman is the founder and CTO of WhiteHat Security. Mr. Grossman is a world-renowned expert in Web security, co-founder of the Web ApplicationSecurity Consortium, and recently named to InfoWorld's Top 25 CTOs for 2007. He has authored dozens of articles and white papers, is credited with the discovery of many cutting-edge attack and defensive techniques, and co-author of the recently published book, Cross-Site Scripting Attacks. Mr. Grossman is frequently quoted in business and technology publications such as InfoWorld, USA Today, PC World, Dark Reading, SC Magazine, SecurityFocus, C-Net, CSO Magazine, and InformationWeek.