Cross-Site Request Forgery

What is Cross-Site Request Forgery (CSRF/XSRF)?

An attack that tricks an authenticated user into unknowingly performing an unwanted action on a vulnerable web application.

What does CSRF primarily target?

State-changing requests such as transferring funds, changing a password, or making a purchase.

A logged-in user clicks a malicious link and their browser unknowingly changes their account email. What attack is this?

Cross-Site Request Forgery (CSRF/XSRF).

What is the attacker's goal in a CSRF attack?

To trick an authenticated victim's browser into submitting a malicious request to a vulnerable application without the victim's consent.

Why does CSRF work?

It exploits the trust a web application has in an authenticated user and their browser.

Does the attacker necessarily see the response from the vulnerable application in a CSRF attack?

No. The attacker may only need to trick the victim's browser into sending the forged request.

What condition must usually be true for a CSRF attack to work?

The victim must have an active authenticated session with the vulnerable web application when the forged request is made.

Which is more associated with CSRF: stealing data or causing unauthorized actions?

Causing unauthorized state-changing actions.

A victim is logged into an online banking application. An attacker tricks the victim's browser into sending a money-transfer request. What attack is occurring?

CSRF.

What is the key difference between CSRF and XSS?

CSRF tricks an authenticated user's browser into performing an unauthorized action, while XSS injects malicious scripts into web pages viewed by users.

What does CSRF exploit: the victim's password directly or the application's trust in the authenticated browser?

The application's trust in the authenticated user and their browser.

A CSRF attack is attempted against a user who is not logged into the target application. What important requirement is missing?

An active authenticated session.

Which type of requests does CSRF commonly target?

State-changing requests, such as transactions, password changes, and purchases.