the-web-application-hackers-handbook

504 Chapter 13 n Attacking Users: Other Techniques
Cross-Site Request Forgery
In cross-site request forgery (CSRF) attacks, the attacker creates an innocuouslooking
website that causes the user’s browser to submit a request directly to
the vulnerable application to perform some unintended action that is beneficial
to the attacker.
Recall that the same-origin policy does not prohibit one website from issuing
requests to a different domain. It does, however, prevent the originating website
from processing the responses to cross-domain requests. Hence, CSRF attacks
normally are “one-way” only. Multistage actions such as those involved in the
Samy XSS worm, in which data is read from responses and incorporated into
later requests, cannot be performed using a pure CSRF attack. (Some methods
by which CSRF techniques can be extended to perform limited two-way attacks,
and capture data cross-domain, are described later in this chapter.)
Consider an application in which administrators can create new user accounts
using requests like the following:
POST /auth/390/NewUserStep2.ashx HTTP/1.1
Host: mdsec.net
Cookie: SessionId=8299BE6B260193DA076383A2385B07B9
Content-Type: application/x-www-form-urlencoded
Content-Length: 83
realname=daf&username=daf&userrole=admin&password=letmein1&
confirmpassword=letmein1
This request has three key features that make it vulnerable to CSRF attacks:
n The request performs a privileged action. In the example shown, the
request creates a new user with administrative privileges.
n The application relies solely on HTTP cookies for tracking sessions. No
session-related tokens are transmitted elsewhere within the request.
n The attacker can determine all the parameters required to perform the
action. Aside from the session token in the cookie, no unpredictable values
need to be included in the request.
Taken together, these features mean that an attacker can construct a web
page that makes a cross-domain request to the vulnerable application containing
everything needed to perform the privileged action. Here is an example of
such an attack: