the-web-application-hackers-handbook

508 Chapter 13 n Attacking Users: Other Techniques
the attacker’s account, this need not be the end of the attack. As described in
Chapter 12, the XSS exploit can persist in the user’s browser and perform arbitrary
actions, logging the user out of her current session with the vulnerable
application and inducing her to log back in using her own credentials.
Preventing CSRF Flaws
CSRF vulnerabilities arise because of how browsers automatically submit cookies
back to the issuing web server with each subsequent request. If a web application
relies solely on HTTP cookies as its mechanism for tracking sessions, it is
inherently at risk from this type of attack.
The standard defense against CSRF attacks is to supplement HTTP cookies
with additional methods of tracking sessions. This typically takes the form
of additional tokens that are transmitted via hidden fields in HTML forms.
When each request is submitted, in addition to validating session cookies, the
application verifies that the correct token was received in the form submission.
Assuming that the attacker has no way to determine the value of this token,
he cannot construct a cross-domain request that succeeds in performing the
desired action.
NOTE Even functions that are robustly defended using CSRF tokens may
be vulnerable to user interface (UI) redress attacks, as described later in this
chapter.
When anti-CSRF tokens are used in this way, they must be subjected to the
same safeguards as normal session tokens. If an attacker can predict the values
of tokens that are issued to other users, he may be able to determine all the
parameters required for a CSRF request and therefore still deliver an attack.
Furthermore, if the anti-CSRF tokens are not tied to the session of the user to
whom they were issued, an attacker may be able to obtain a valid token within his
own session and use this in a CSRF attack that targets a different user’s session.
TRY IT!
http://mdsec.net/auth/395/
http://mdsec.net/auth/404/
WARNING Some applications use relatively short anti-CSRF tokens on the
assumption that they will not be subjected to brute-force attacks in the way
that short session tokens might be. Any attack that sent a range of possible
values to the application would need to send these via the victim’s browser,
involving a large number of requests that might easily be noticed. Furthermore,