Cross Site Request Forgery is a web-based vulnerability by which an attacker can send unauthorized commands to a site, via an authenticated user. This attack forces the user to unwittingly send commands to the website by embedding malicious URLs into HTML code that the target then execute, such as clicking a hyperlink or viewing an image referencing the URL. Since the request comes from the authenticated user it can be very difficult to determine when a CSRF attack has occured.
Consider the following HTTP header code (borrowed from DVWA):
GET /dvwa/vulnerabilities/csrf/?password_new=mynewpasswd&password_conf=mynewpasswd&Change=Change HTTP/1.1
This shows the parameters sent to the website in order to perform a password change on an account. Since we know what variables are required to be sent in the URL from the request above, it is possible to construct a custom URL in order to change the password, for example:
www.example.com/dvwa/vulnerabilities/csrf/?password_new=expl0ited&password_conf=expl0ited&Change=Change
Now that we have the URL, we need to get the admin to “launch” it. This is where CSRF comes into it’s own as a stealth attack, since the target does not need to explicitly click a link in order for them to execute this code, the URL can be easily hidden deep within some HTML code such as an image:
<img src="http://www.example.com/dvwa/vulnerabilities/csrf/?password_new=abcd&password_conf=abcd&Change=Change" alt="" width="1" height="1" border="0" />
Images are preferable to using hyperlinks, since the hyperlink will then redirect the user to the CSRF page, where they will see a change has occured (such as a confirmation page of password change). By embedding the link as a zero-byte image, the malicious URL is still submitted to the website upon viewing the malicious website/email, however no visual indicator is then displayed to recognise that the action has taken place.
There are however caveats to this method, including:
- The target needs to be logged-in to the site in order for the attack to work
- The site mustn’t check the HTTP referrer header (a CSRF attack will not have a correct referrer since the request did not originate from the actual website)
- The target must be lured into executing the malicious URL
While it is assumed that only HTTP GET requests are vulnerable to CSRF, as only this allows the malicious URL to be constructed, there are tools to perform CSRF attacks for HTTP POST requests. For example, the CSRF Redirector can be used to forge HTTP POST requests. Another converter can be found here.