Login Form Cross-Site Request Forgery

low Web App Scanning Plugin ID 113332

Language:

Synopsis

Description

Cross Site Request Forgery (CSRF) occurs when an user is tricked into clicking on a link which would automatically submit a request without the user's consent.

This can be made possible when the request does not include an anti-CSRF token, generated each time the request is visited and passed when the request is submitted, and which can be used by the web application backend to verify that the request originates from a legitimate user.

Exploiting requests vulnerable to Cross-Site Request Forgery requires different factors:

- The request must perform a sensitive action.

- The attacker must make the victim click on a link to send the request without their consent.

The exploitation of this vulnerability will in most cases have a very limited impact. However, it is possible to create complex scenarios in case the application is also vulnerable to Cross-Site Scripting.

Solution

Update the application by adding support of anti-CSRF tokens on this login form.
Most web frameworks provide either built-in solutions or have plugins that can be used to easily add these tokens to any form. Check the references for possible solutions provided for the most known frameworks.