A8 Cross-Site Request Forgery (CSRF)

CSRF exploits the trust that a site has in a user’s browser.  i.e. In CSRF, attacker creates a forged HTTP request and sends it to the victim’s browser by any means and force user to click on that link. If victim clicks that link, server considers it as a legitimate request and serves that request.

Impact on Security:

• Attack on Integrity

Detectability   : Easy

Exploitability  : Average

Impact           : Moderate

Possible Mitigation:

1. Include hte unique token in a hidden field. Prefer to include it in the body of HTTP request instead of including it in URL.
2. Use CSRF Guard or ESAPI.
3. Use CAPTCHA to prove they are user.