CSRF attacks are common web app vulnerabilities that take advantage of the trust a website has already granted a user 和 their browser.
2023年中威胁报告跨站点请求伪造(CSRF)攻击 常见的web应用程序漏洞 that take advantage of the trust a website has already granted a user 和 their browser. 在CSRF攻击中, an attacker typically uses social engineering techniques to manipulate an authenticated user into executing malicious actions without their awareness or consent. Simply by clicking on a legitimate-seeming link in an email or 聊天信息, the user may unwittingly give an attacker the ability to co-opt their identity 和 access privileges.
从那时起, the attacker can impersonate their victim 和 use their account to perform anything from a harmless prank on an unsuspecting user to an illicit money transfer that drains the victim’s bank account. 如果目标用户是具有广泛访问权限的web管理员, CSRF攻击可以危及整个web应用程序.
当成功, a CSRF attack can be harmful both to the business operating the site 和 the user who has accessed it. 这样的 利用 是否会对客户关系产生负面影响, 损害客户信心, 并导致欺诈或盗窃财务资源的情况. CSRF attacks have been employed against major services 和 sites such as Gmail 和 Facebook, 等.
CSRF还有许多其他名称, 包括XSRF, “海上冲浪,“会议骑行”, 跨站点引用伪造, 敌意链接. Microsoft refers to this type of attack as a one-click attack in its threat modeling process 和 many places in its online documentation. CSRF被认为是OWASP Top 10中的A5类缺陷.
当用户试图访问站点时, their browser often automatically includes any credentials associated with the site along with their request so that the login process is more convenient. 这些凭证可以包括用户的会话cookie, 基本身份验证凭据, IP地址, Windows域凭据, 等等....... 一旦用户通过了站点的身份验证, 然而, the site has no way to distinguish a forged request from a legitimate user request.
通过CSRF攻击盗用受害者的身份和访问权限, 攻击者可以让用户执行意想不到的操作. 通常, the attacker persuades a victim to click on a link by using a social-engineering technique via an email, 聊天信息, 或者类似的交流方式. The user may then unknowingly encounter malicious HTML or JavaScript code in the email message or after loading a site page that requests a specific task URL. The task then executes, either directly or by using a cross-site scripting flaw. The user is often unaware that anything has happened until after a malicious action has occurred.
CSRF attacks usually target functions that cause a state change on the server but can also be used to access sensitive data. 在对受害者的账户执行成功的CSRF攻击后, 恶意行为者可以发起资金转移, 购买一件物品, 将产品放入购物车, 更改帐户信息，如送货地址, 修改密码, 或使用易受攻击网站上提供的任何其他功能.
In some cases, it is possible to store a CSRF attack directly on the vulnerable site itself. 这种漏洞被称为存储CSRF漏洞. An attacker can create a stored CSRF flaw simply by storing an IMG or IFRAME tag in a field that accepts HTML, 或者通过一个更复杂的 跨站点脚本攻击. The Samy MySpace worm is a notable case in which XSS techniques compromised a site on a mass scale.
If an attacker is able to store a CSRF attack on the target site, the impact can be far more severe. 在这种情况下, since the page containing the malicious payload is now contained within the site 和 therefore appears entirely legitimate, the victim is more likely to view 和 trust the page containing the attack than a r和om page on the internet. And since the victim has already been authenticated to the site in this scenario, the attacker will have an even better opportunity to target them with a CSRF attack.
有几种方法可以增强你的记忆力 Web应用程序安全性 程序，使您不那么容易受到潜在的CSRF攻击. 与其他web应用程序安全措施一样, the best defense involves regularly scanning 和 testing the security of your web applications:
如果您的web应用程序目前没有CSRF保护, 它很容易受到这种形式的攻击. Web application security tools can help you quickly determine whether such a vulnerability exists within your web application 和 provide you with steps to remediate the issue.
You can help reduce the likelihood of a CSRF attack by having advanced validation techniques in place for anyone who may visit pages on your site, 特别是如果你经营一个社交媒体或社区网站. CSRF令牌, which are sometimes also referred to as anti-CSRF令牌 since they are intended to deflect CSRF attacks, 有这样一个例子吗?. 通常由一个大的, r和om string of numbers that is unique to both the individual session 和 the user, they make it much harder for attackers to guess the proper token required to create a valid request.
By implementing CSRF令牌 in your form submissions 和 side-effect URLs, you can better ensure that every form submission or request is tied to an authenticated user 和 shielded from a potential CSRF attack. 在涉及高度敏感操作的情况下， OWASP notes that you may also want to consider implementing a user interaction based protection (either re-authentication/one-time token along) along with token based mitigation techniques.
Even after you have successfully resolved a vulnerability in a web application that would have enabled a CSRF attack, it is still possible for vulnerabilities to arise in the future as the application is updated 和 changes are made to its code. 出于这个原因, it’s wise to continually scan 和 test your web applications for any security vulnerabilities they may harbor, 包括与CSRF攻击相关的漏洞, 使用web应用程序安全工具.
Although CSRF attacks only work on users that are currently authenticated to a site, 这些攻击一旦成功，可能是毁灭性的. An attacker who has impersonated a user can then proceed to perform a range of actions without their knowledge or consent, 偷钱或诈骗.
一家公司可能会发现自己的声誉因此受到严重损害, experiencing a loss of customer trust 和 even facing regulatory fines in some cases. 通过积极主动的全面实施 应用程序安全程序，您的企业可以减少这种攻击的可能性.