> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/cross-site-request-forgery-csrf.md).

# Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is a vulnerability that allows an attacker to trick an authenticated user into performing unwanted actions on a web application.

The attack works because the victim's browser automatically includes authentication credentials, such as session cookies, when sending requests to the target application. If the application does not verify whether the request was intentionally made by the user, an attacker may be able to perform actions on the victim's behalf.

Common targets include:

* Password changes
* Email changes
* Profile updates
* Fund transfers
* Account settings modifications
* Administrative actions

***

### How to Exploit

1. Identify an application function that performs sensitive actions, such as changing account settings or updating user information.
2. Verify that the application relies solely on the user's session for authentication.
3. Check whether the application uses any CSRF protection mechanism to validate the origin of the request.
4. If no protection exists, an attacker can create a malicious page that causes the victim's browser to send a request to the vulnerable application.
5. When the victim visits the attacker's page while logged into the target application, the browser automatically includes the victim's session cookies.
6. The target application processes the request as if it were submitted directly by the authenticated user.
7. The requested action is completed using the victim's account and permissions.

***

### Impact

* **Unauthorized actions:** Perform actions on behalf of an authenticated user without their consent.
* **Account modification:** Change account settings, passwords, or email addresses.
* **Financial fraud:** Initiate unauthorized transactions or payments.
* **Privilege abuse:** Trigger administrative actions if the victim is an administrator.
* **Account takeover:** Change security settings to facilitate unauthorized account access.

The impact depends on the functionality being targeted and the privileges of the affected user.

***

### Recommendations

* **Use anti-CSRF tokens:** Include unique, unpredictable tokens in state-changing requests.
* **Implement SameSite cookies:** Set the `SameSite` attribute (`Lax` or `Strict`) to limit cross-site requests.
* **Validate the Origin and Referer headers:** Reject requests from untrusted origins.
* **Use secure session management:** Protect session cookies with the `Secure` and `HTTPOnly` flags.