Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-352 (跨站请求伪造(CSRF)) — Vulnerability Class 4773

4773 vulnerabilities classified as CWE-352 (跨站请求伪造(CSRF)). AI Chinese analysis included.

CWE-352, Cross-Site Request Forgery, is a web application weakness where the system fails to verify that an incoming request was intentionally initiated by the authenticated user rather than an unauthorized actor. Attackers typically exploit this vulnerability by tricking a victim into submitting a malicious request, often via a hidden link or form on a third-party site, while the victim is logged into the target application. Because the browser automatically includes valid session cookies, the server processes the forged request as legitimate, potentially allowing unauthorized actions like fund transfers or profile changes. Developers mitigate this risk by implementing anti-CSRF tokens, synchronizer tokens, or validating the Origin and Referer headers to ensure requests originate from trusted sources, thereby preventing unauthorized state changes.

MITRE CWE Description
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Common Consequences (1)
Confidentiality, Integrity, Availability, Non-Repudiation, Access ControlGain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data, DoS: Crash, Exit, or Restart
The consequences will vary depending on the nature of the functionality that is vulnerable to CSRF. An attacker could trick a client into making an unintentional request to the web server via a URL, image load, XMLHttpRequest, etc., which would then be treated as an authentic request from the client…
Mitigations (5)
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
ImplementationEnsure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and DesignGenerate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and DesignIdentify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and DesignUse the "double-submitted cookie" method as described by Felten and Zeller: When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the f…
Examples (1)
This example PHP code attempts to secure the form submission process by validating that the user submitting the form has a valid session. A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists.
<form action="/url/profile.php" method="post"> <input type="text" name="firstname"/> <input type="text" name="lastname"/> <br/> <input type="text" name="email"/> <input type="submit" name="submit" value="Update"/> </form>
Bad · HTML
// initiate the session in order to validate sessions session_start(); //if the session is registered to a valid user then allow update if (! session_is_registered("username")) { echo "invalid session detected!"; // Redirect user to login page [...] exit; } // The user session is valid, so process the request // and update the information update_profile(); function update_profile { // read in the data from $POST and send an update // to the database SendUpdateToDatabase($_SESSION['username'], $_POST['email']); [...] echo "Your profile has been successfully updated."; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2018-0259 Cisco MATE Collector 跨站请求伪造漏洞 — Cisco MATE Collector 8.8 -2018-04-19
CVE-2018-1098 etcd 跨站请求伪造漏洞 — etcd 8.8 -2018-04-03
CVE-2018-7524 Geutebrück G-Cam/EFD-2250和Topline TopFD-2125 跨站请求伪造漏洞 — Geutebr&#195;&#188;ck G-Cam/EFD-2250 (part n&#194;&#176; 5.02024) firmware and Topline TopFD-2125 (part n&#194;&#176; 5.02820) firmware 8.8 -2018-03-22
CVE-2017-0933 Ubiquiti Networks EdgeOS 跨站请求伪造漏洞 — EdgeRouter X 8.0 -2018-03-22
CVE-2018-1230 Pivotal Spring Batch Admin 跨站请求伪造漏洞 — Spring Batch Admin 8.8 -2018-03-21
CVE-2018-0210 Cisco Data Center Network Manager 跨站请求伪造漏洞 — Cisco Data Center Network Manager 8.8 -2018-03-08
CVE-2018-0215 Cisco Identity Services Engine 跨站请求伪造漏洞 — Cisco Identity Services Engine 8.8 -2018-03-08
CVE-2018-0216 Cisco Identity Services Engine 跨站请求伪造漏洞 — Cisco Identity Services Engine 8.8 -2018-03-08
CVE-2018-0146 Cisco Data Center Analytics Framework应用程序跨站请求伪造漏洞 — Cisco Data Center Analytics Framework 8.1 -2018-02-22
CVE-2018-0148 Cisco UCS Director Software和Cisco Integrated Management Controller Supervisor Software 跨站请求伪造漏洞 — Cisco UCS Director and Cisco Integrated Management Controller Supervisor 8.8 -2018-02-22
CVE-2018-0107 Cisco Prime Service Catalog 跨站脚本漏洞 — Cisco Prime Service Catalog 8.8 -2018-01-18
CVE-2017-5263 Cambium Networks cnPilot 安全漏洞 — cnPilot 8.8 -2017-12-20
CVE-2017-5264 Rapid7 Nexpose 安全漏洞 — Nexpose 8.8 -2017-12-14
CVE-2017-12271 Cisco SPA300和SPA500 Series IP Phones 跨站请求伪造漏洞 — Cisco SPA300 and SPA500 Series IP Phones 8.8 -2017-10-19
CVE-2017-14011 ProMinent MultiFLEX M10a Controller Web界面跨站请求伪造漏洞 — ProMinent MultiFLEX M10a Controller 8.8 -2017-10-17
CVE-2017-12253 Cisco Unified Intelligence Center 跨站请求伪造漏洞 — Cisco Unified Intelligence Center 8.8 -2017-09-21
CVE-2017-7926 OSIsoft PI Web API 跨站请求伪造漏洞 — OSIsoft PI Web API 2017 8.8 -2017-08-25
CVE-2017-5187 Micro Focus Enterprise Developer和Enterprise Server Directory Server 跨站请求伪造漏洞 — Micro Focus Enterprise Developer, Micro Focus Enterprise Server 8.8 -2017-08-21
CVE-2017-7423 Micro Focus Enterprise Developer和Enterprise Server 跨站请求伪造漏洞 — Micro Focus Enterprise Developer, Micro Focus Enterprise Server 8.1 -2017-08-21
CVE-2017-7556 Hawtio 跨站请求伪造漏洞 — hawtio 8.1 -2017-08-17
CVE-2017-6756 Cisco Prime Collaboration Provisioning tool 跨站请求伪造漏洞 — Cisco Prime Collaboration Provisioning Tool 8.8 -2017-08-07
CVE-2017-6038 Belden Hirschmann GECKO Lite Managed Switch 跨站请求伪造漏洞 — Belden Hirschmann GECKO 8.1 -2017-06-30
CVE-2017-6042 Sierra Wireless AirLink Raven XE和XT 跨站请求伪造漏洞 — Sierra Wireless AirLink Raven XE and XT 8.8 -2017-06-30
CVE-2017-5244 Rapid7 Metasploit Express、Community和Pro 跨站请求伪造漏洞 — Metasploit (Pro, Express, and Community editions) 6.5 -2017-06-15
CVE-2017-7917 多款摩莎产品跨站请求伪造漏洞 — Moxa OnCell 8.8 -2017-05-29
CVE-2017-6634 Cisco Industrial Ethernet 1000 Series Switches 跨站请求伪造漏洞 — Cisco Industrial Ethernet 1000 Series Switches 8.8 -2017-05-22
CVE-2017-2688 Siemens RUGGEDCOM ROX I 跨站请求伪造漏洞 — RUGGEDCOM ROX I All versions 8.8 -2017-03-29
CVE-2016-9127 Revive Adserver 跨站请求伪造漏洞 — Revive Adserver All versions before 3.2.3 6.5 -2017-03-28
CVE-2016-9455 Revive Adserver 跨站请求伪造漏洞 — Revive Adserver All versions before 3.2.3 8.8 -2017-03-28
CVE-2016-9456 Revive Adserver 跨站请求伪造漏洞 — Revive Adserver All versions before 3.2.3 8.8 -2017-03-28

Vulnerabilities classified as CWE-352 (跨站请求伪造(CSRF)) represent 4773 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.