Example and Characteristics
The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated. For example, one user, Alice, might be browsing a chat forum where another user, Eve, has posted a message. Suppose that Eve has crafted an HTML image element that references an action on Alice's bank's website (rather than an image file), e.g.,
If Alice's bank keeps her authentication information in a cookie, and if the cookie hasn't expired, then the attempt by Alice's browser to load the image will submit the withdrawal form with her cookie, thus authorizing a transaction without Alice's approval.
A cross-site request forgery is a confused deputy attack against a Web browser. The deputy in the bank example is Alice's Web browser which is confused into misusing Alice's authority at Eve's direction.
The following characteristics are common to CSRF:
- Involve sites that rely on a user's identity
- Exploit the site's trust in that identity
- Trick the user's browser into sending HTTP requests to a target site
- Involve HTTP requests that have side effects
At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action.
CSRF attacks using image tags are often made from Internet forums, where users are allowed to post images but not JavaScript.
CSRF attacks are often exploited in pair with XSS attacks, making CSRF vulnerabilities much more dangerous. Existence of an XSS vulnerability quite often allows to bypass the majority of existent anti-CSRF mechanisms. Such examples are described in details in "XSS & CSRF: Practical exploitation of post-authentication vulnerabilities in web applications" publication.
Read more about this topic: Cross-site Request Forgery