{ "id": "bundle--d6793b84-bf51-4140-ae4a-d716cdcc2a04", "objects": [ { "created": "2014-06-23T00:00:00.000Z", "created_by_ref": "identity--e50ab59c-5c4f-4d40-bf6a-d58418d89bcd", "description": "An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply \"riding\" the existing session cookie.", "external_references": [ { "external_id": "CAPEC-62", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/62.html" }, { "external_id": "CWE-352", "source_name": "cwe", "url": "http://cwe.mitre.org/data/definitions/352.html" }, { "external_id": "CWE-306", "source_name": "cwe", "url": "http://cwe.mitre.org/data/definitions/306.html" }, { "external_id": "CWE-664", "source_name": "cwe", "url": "http://cwe.mitre.org/data/definitions/664.html" }, { "external_id": "CWE-732", "source_name": "cwe", "url": "http://cwe.mitre.org/data/definitions/732.html" }, { "external_id": "CWE-1275", "source_name": "cwe", "url": "http://cwe.mitre.org/data/definitions/1275.html" }, { "description": "Cross-Site Request Forgery", "external_id": "09", "source_name": "WASC", "url": "http://projects.webappsec.org/Cross-Site-Request-Forgery" }, { "description": "Cross Site Request Forgery (CSRF)", "source_name": "OWASP Attacks", "url": "https://owasp.org/www-community/attacks/csrf" }, { "description": "Thomas Schreiber, Session Riding: A Widespread Vulnerability in Today's Web Applications, SecureNet GmbH", "external_id": "REF-62", "source_name": "reference_from_CAPEC", "url": "https://crypto.stanford.edu/cs155old/cs155-spring08/papers/Session_Riding.pdf" }, { "description": "OWASP Web Security Testing Guide, The Open Web Application Security Project (OWASP)", "external_id": "REF-602", "source_name": "reference_from_CAPEC", "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/05-Testing_for_Cross_Site_Request_Forgery.html" } ], "id": "attack-pattern--0939f361-ea31-454b-ae3d-4af2411b756d", "modified": "2021-06-24T00:00:00.000Z", "name": "Cross Site Request Forgery", "object_marking_refs": [ "marking-definition--17d82bb2-eeeb-4898-bda5-3ddbcd2b799d" ], "spec_version": "2.1", "type": "attack-pattern", "x_capec_abstraction": "Standard", "x_capec_alternate_terms": [ "Session Riding" ], "x_capec_child_of_refs": [ "attack-pattern--2351ee64-dd85-4bc3-bb43-aaa2ca5c1228" ], "x_capec_consequences": { "Access_Control": [ "Gain Privileges" ], "Authorization": [ "Gain Privileges" ], "Confidentiality": [ "Gain Privileges", "Read Data" ], "Integrity": [ "Modify Data" ] }, "x_capec_domains": [ "Software" ], "x_capec_example_instances": [ "\n While a user is logged into their bank account, an attacker can send an email with some potentially interesting content and require the user to click on a link in the email.\n The link points to or contains an attacker setup script, probably even within an iFrame, that mimics an actual user form submission to perform a malicious activity, such as transferring funds from the victim's account.\n The attacker can have the script embedded in, or targeted by, the link perform any arbitrary action as the authenticated user. When this script is executed, the targeted application authenticates and accepts the actions based on the victims existing session cookie.See also: Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51 allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail." ], "x_capec_execution_flow": "

Execution Flow

Explore

  1. Explore target website: The attacker first explores the target website to determine pieces of functionality that are of interest to them (e.g. money transfers). The attacker will need a legitimate user account on the target website. It would help to have two accounts.

    2. Techniques
    Use web application debugging tool such as WebScarab, Tamper Data or TamperIE to analyze the information exchanged between the client and the server
    Use network sniffing tool such as Wireshark to analyze the information exchanged between the client and the server
    View HTML source of web pages that contain links or buttons that perform actions of interest.

Experiment

  1. Create a link that when clicked on, will execute the interesting functionality.: The attacker needs to create a link that will execute some interesting functionality such as transfer money, change a password, etc.

    2. Techniques
    Create a GET request containing all required parameters (e.g. https://www.somebank.com/members/transfer.asp?to=012345678901&amt=10000)
    Create a form that will submit a POST request (e.g.

Exploit

  1. Convince user to click on link: Finally, the attacker needs to convince a user that is logged into the target website to click on a link to execute the CSRF attack.

    2. Techniques
    Execute a phishing attack and send the user an e-mail convincing them to click on a link.
    Execute a stored XSS attack on a website to permanently embed the malicious link into the website.
    Execute a stored XSS attack on a website where an XMLHTTPRequest object will automatically execute the attack as soon as a user visits the page. This removes the step of convincing a user to click on a link.
    Include the malicious link on the attackers' own website where the user may have to click on the link, or where an XMLHTTPRequest object may automatically execute the attack when a user visits the site.
", "x_capec_likelihood_of_attack": "High", "x_capec_parent_of_refs": [ "attack-pattern--c50d5a35-0010-422d-b6f7-d4b963c9bad4" ], "x_capec_resources_required": [ "All the attacker needs is the exact representation of requests to be made to the application and to be able to get the malicious link across to a victim." ], "x_capec_skills_required": { "Medium": "The attacker needs to figure out the exact invocation of the targeted malicious action and then craft a link that performs the said action. Having the user click on such a link is often accomplished by sending an email or posting such a link to a bulletin board or the likes." }, "x_capec_status": "Draft", "x_capec_typical_severity": "Very High", "x_capec_version": "3.9" } ], "type": "bundle" }