Cross-Site Request Forgery
Cross-site request forgery is a web attack that forces an end-user to perform an unwanted activity like click on the image, sending a link via URL, etc. With little help of social engineering, an attacker may trick a user of a web application into executing task choosing of attackers. If the victim is a normal user so attackers may easily trick victims that perform fund transfer, changing the email address.
CSRF is also known as XSRF, sea surf, session riding,cross-site reference forgery, hostile linking. Microsoft refers to as “one-click” attack.
HOW DOES ATTACK WORK
The number of the way that attackers may trick a victim to submit information or into loading information form to the web application. before understanding “how does attack work” First we have to understand how to generate a malicious request. Let’s understand an example Ramu wants to send 10,000 rupees to his father Gyanu through web application money.com, This website is vulnerable to csrf.Hacker_babu wants to trick Ramu to send money to her account.he will comprise the following steps.
- build exploit URL or Script
- He tricks Ramu to force fund transfer activity by showing an image or something else like social engineering(it is a malicious activity that accomplished through human interactions)
HOW TO PREVENT CROSS SITE REQUEST FORGERY:
Train and maintain awareness:- To keep your web application safe, everyone involved in building web applications must be aware of the risks associated with csrf vulnerabilities so provide suitable security training to all developers.
Assess the risk:- Csrf vulnerabilities do not apply to the public content. They are only dangerous when authentication is required. Therefore you can ignore this risk if you have public content on your website. However, if you have a web application with your account, Treat csrf as a major risk if you have an e-commerce application.
Use anti-csrf tokens: Anti csrf tokens are considered the most effective methods of protecting against csrf. Use a tested implementation such as CSRFGuard for java or CSRFprotector for PHP to implement your anti-csrf Tokens. Also, develop your mechanism only if there is no existing one for your environment.
Use same-site cookies: Set the SameSite attribute of your cookies to Strict. If this would break your web application functionality, set the SameSite attribute to Lax, but never to None. Not all browsers support SameSite cookies yet, but most do.
Scan Regularly: CSRF vulnerabilities may be introduced by your developers or through external libraries/modules/software. You should regularly scan your web applications using a web vulnerability scanner such as Acunetix. If you use Jenkins, you should install the Acunetix plugin to automatically scan every build.
References:-
