Cross-site
request forgery (CSRF) is an attack where the legitimate user trapped by an
unauthorized user to perform an unintended task to a website where they are
authenticated.
Since HTTP is a stateless protocol, cookies are used to
validate the request agent. Once the user login to a website, it will not
require to type the username and password for each attempt. Hence, for the
server to identify the user, the server generates a session identifier and
sends it as a set-cookie header to the client browser with the very first
response. The cookie set by the server will be saved in the client browser and,
the cookie will be sent along with every request made to the server (Where the
domain and path are matched). However, the server does not check any other
attribute but session identifier. Although the request is made from another
client, the website only verifies whether the requesting user is already
authenticated or not, using a cookie.
The website
can have a form with hidden fields, but the site shows fewer that seems legitimate.
<body
onload="document.forms[0].submit()">
<form action="http://netbank.com/transfer.do"
method="POST">
<input type="hidden" name="acct"
value="AttackerA"/>
<input type="hidden" name="amount"
value="$100"/>
<input type="submit" value="View my
pictures!"/>
</form>
</body>The above example, code is implemented to transfer the amount of money to the attacker account without the user’s knowledge. But the website only displays a button with the text says, “View my picture.” If the user clicks on this button, the request is sent from the user’s browser. The request will be sent with a session cookie stored in the browser. Also, the server will accept the request and complete the function above without hesitation. Moreover, an attacker can gain access over the account using a CSRF attack.
To overcome this kind of vulnerability, a unique value for
each client session is used. This type of unique value is called the CSRF
token. Those tokens are random cryptographic values that are generated when a
session is started for a particular user. Each form in the website has token within
the message body as a hidden field.
If the above attack scenario occurs, the form which is sent
by the attacker to the legitimate doesn’t have any token value to verify or the token value that the attacker sent along with the form won't be matched.
Because CSRF token value is unique to each session and the attacker is not
aware of the token of the legitimate user.
There are two types of CSRF protection methods that are commonly used
today.
These two protection implementations generate CSRF token and
validate the token against the session id.
Comments
Post a Comment