跳转到内容

User:Zhibinr/跨站请求伪造

本页使用了标题或全文手工转换
维基百科，自由的百科全书

跨站请求伪造（英語：Cross-site request forgery），也被称为 one-click attack 或者 session riding，通常缩写为 CSRF 或者 XSRF， 是一种挟制用户在当前已登录的Web应用程序上执行非本意的操作的攻击方法。[1] 跟跨網站指令碼（XSS）相比，XSS 利用的是用户对指定网站的信任，CSRF 利用的是网站对用户网页浏览器的信任。

History[编辑]

CSRF vulnerabilities have been known and in some cases exploited since 2001.[2] Because it is carried out from the user's IP address, some website logs might not have evidence of CSRF.[1] Exploits are under-reported, at least publicly, and as of 2007[3] there are few well-documented examples. About 18 million users of eBay's Internet Auction Co. at Auction.co.kr in Korea lost personal information in February 2008.[4] Customers of a bank in Mexico were attacked in early 2008 with an image tag in email. The link in the image tag changed the DNS entry for the bank in their ADSL router to point to a malicious website impersonating the bank.[5]

Example and characteristics[编辑]

A National Vulnerability Database page describing a CSRF vulnerability

The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated.[6] For example, one user, Alice, might be browsing a chat forum where another user, Mallory, has posted a message. Suppose that Mallory has crafted an HTML image element that references an action on Alice's bank's website (rather than an image file), e.g.,

Mallory: Hello Alice! Look here:
   <img src="http://bank.example.com/withdraw?account=Alice&amount=1000000&for=Mallory">

If Alice's bank keeps her authentication information in a cookie, and if the cookie hasn't expired, then the attempt by Alice's browser to load the image will submit the withdrawal form with her cookie, thus authorizing a transaction without Alice's approval.

A cross-site request forgery is a confused deputy attack against a Web browser. The deputy in the bank example is Alice's Web browser which is confused into misusing Alice's authority at Mallory's direction.

The following characteristics are common to CSRF:

  • Involve sites that rely on a user's identity
  • Exploit the site's trust in that identity
  • Trick the user's browser into sending HTTP requests to a target site
  • Involve HTTP requests that have side effects

At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action.

CSRF attacks using image tags are often made from Internet forums, where users are allowed to post images but not JavaScript.

Limitations[编辑]

Several things have to happen for cross-site request forgery to succeed:

  1. The attacker must target either a site that doesn't check the referrer header (which is common) or a victim with a browser or plugin that allows referer spoofing (which is rare).
  2. The attacker must find a form submission at the target site, or a URL that has side effects, that does something (e.g., transfers money, or changes the victim's e-mail address or password).
  3. The attacker must determine the right values for all the forms or URL inputs; if any of them are required to be secret authentication values or IDs that the attacker can't guess, the attack will fail.
  4. The attacker must lure the victim to a Web page with malicious code while the victim is logged into the target site.

Note that the attack is blind; i.e., the attacker can't see what the target website sends back to the victim in response to the forged requests, unless they exploit a cross-site scripting or other bug at the target website. Similarly, the attacker can only target any links or submit any forms that come up after the initial forged request if those subsequent links or forms are similarly predictable. (Multiple targets can be simulated by including multiple images on a page, or by using JavaScript to introduce a delay between clicks.)

Given these constraints, an attacker might have difficulty finding logged-in victims or attackable form submissions. On the other hand, attack attempts are easy to mount and invisible to victims, and application designers are less familiar with and prepared for CSRF attacks than they are for, say, password-guessing dictionary attacks.

Severity[编辑]

According to the United States Department of Homeland Security the most dangerous CSRF vulnerability ranks as the 909th most dangerous software bug ever found.[7] Other severity metrics have been issued for CSRF vulnerabilities that result in remote code execution with root privileges[8] as well as a vulnerability that can compromise a root certificate, which will completely undermine a public key infrastructure.[9]

Forging login requests[编辑]

An attacker may forge a request to log the victim into a target website using the attacker's credentials; this is known as login CSRF. Login CSRF makes various novel attacks possible; for instance, an attacker can later log into the site with his legitimate credentials and view private information like activity history that has been saved in the account.[10] The attack has been demonstrated against YouTube.[11]

Other approaches to CSRF[编辑]

Additionally, while typically described as a static type of attack, CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack, as demonstrated by the Samy worm, or constructed on the fly from session information leaked via offsite content and sent to a target as a malicious URL. CSRF tokens could also be sent to a client by an attacker due to session fixation or other vulnerabilities, or guessed via a brute-force attack,[12] rendered on a malicious page that generates thousands of failed requests. The attack class of "Dynamic CSRF", or using a per-client payload for session-specific forgery, was described[13] in 2009 by Nathan Hamiel and Shawn Moyer at the BlackHat Briefings,[14] though the taxonomy has yet to gain wider adoption.

A new vector for composing dynamic CSRF attacks was presented by Oren Ofer at a local OWASP chapter meeting on January 2012 - "AJAX Hammer - Dynamic CSRF".[15][16]

Prevention[编辑]

Individual Web users using unmodified versions of the most popular browsers can do relatively little to prevent cross-site request forgery. Logging out of sites and avoiding their "remember me" features can mitigate CSRF risk; not displaying external images or not clicking links in spam or untrusted e-mails may also help.

Browser extensions such as RequestPolicy (for Mozilla Firefox) can prevent CSRF by providing a default-deny policy for cross-site requests. However, this can significantly interfere with the normal operation of many websites. The CsFire extension (also for Firefox) can mitigate the impact of CSRF with less impact on normal browsing, by removing authentication information from cross-site requests. The NoScript extension for Firefox mitigates CSRF threats by distinguishing trusted from untrusted sites, and removing payloads from POST requests sent by untrusted sites to trusted ones. The Self Destructing Cookies extension for Firefox does not directly protect from CSRF, but can reduce the attack window, by deleting cookies as soon as they are no longer associated with an open tab.

Web sites have various CSRF countermeasures available:

  • Requiring a secret, user-specific token in all form submissions and side-effect URLs prevents CSRF; the attacker's site cannot put the right token in its submissions.[6] This technique is commonly referred to as the Synchronizer Token Pattern.[17]
  • Requiring the client to provide authentication data in the same HTTP Request used to perform any operation with security implications (money transfer, etc.)
  • Limiting the lifetime of session cookies
  • Ensuring that there is no clientaccesspolicy.xml file granting unintended access to Silverlight controls[18]
  • Ensuring that there is no crossdomain.xml file granting unintended access to Flash movies[19]
  • Verifying that the request's header contains a X-Requested-With (used by Ruby on Rails before v2.0 and Django before v1.2.5), or checking the HTTP Referer header and/or HTTP Origin header.[20] These protections have been proven insecure under a combination of browser plugins and redirects which can allow an attacker to provide custom HTTP headers on a request to any website, hence allowing a forged request.[21][22]

One solution is to use a CSRF filter. Such a filter can intercept responses, detects if it is a html document and inserts a token into the forms and optionally inserts script to insert tokens in Ajax functions. The filter may also intercept requests to check that the token is present.

A variation on this approach is to double submit cookies for users who use JavaScript. If an authentication cookie is read using JavaScript before the post is made, JavaScript's stricter (and more correct) cross-domain rules will be applied. If the server requires requests to contain the value of the authentication cookie in the body of POST requests or the URL of dangerous GET requests, then the request must have come from a trusted domain, since other domains are unable to read cookies from the trusting domain.

Checking the HTTP Referer header to see if the request is coming from an authorized page is commonly used for embedded network devices because it does not increase memory requirements. However a request that omits the Referer header must be treated as unauthorized because an attacker can suppress the Referer header by issuing requests from FTP or HTTPS URLs. This strict Referer validation may cause issues with browsers or proxies that omit the Referer header for privacy reasons. Also, old versions of Flash (before 9.0.18) allow malicious Flash to generate GET or POST requests with arbitrary HTTP request headers using CRLF Injection.[23] Similar CRLF injection vulnerabilities in a client can be used to spoof the referrer of an HTTP request.

To prevent forgery of login requests, sites can use these CSRF countermeasures in the login process, even before the user is logged in.

Sites with especially strict security needs, like banks, often log users off after (for example) 15 minutes of inactivity.

Using the HTTP specified usage for GET and POST, in which GET requests never have a permanent effect, is good practice but is not sufficient to prevent CSRF. Attackers can write JavaScript or ActionScript that invisibly submits a POST form to the target domain. However, filtering out unexpected GETs prevents some particular attacks, such as cross-site attacks using malicious image URLs or link addresses and cross-site information leakage through <script> elements (JavaScript hijacking); it also prevents (non-security-related) problems with aggressive web crawlers and link prefetching.[6]

Cross-site scripting (XSS) vulnerabilities (even in other applications running on the same domain) allow attackers to bypass CSRF preventions.[24]

See also[编辑]

References[编辑]

  1. ^ 1.0 1.1 Ristic, Ivan. Apache Security. O'Reilly Media. 2005: 280. ISBN 0-596-00724-8. 
  2. ^ Burns, Jesse. Cross Site Request Forgery: An Introduction To A Common Web Weakness (PDF). Information Security Partners, LLC. 2005 [2011-12-12]. 
  3. ^ Christey, Steve and Martin, Robert A. Vulnerability Type Distributions in CVE (version 1.1). MITRE Corporation. May 22, 2007 [2008-06-07]. 
  4. ^ Hacker Steals Data on 18M Auction Customers in South Korea. DarkReader. February 2008 [13 April 2012]. 
  5. ^ List of incidents for which Attack Method is Cross Site Request Forgery (CSRF). Web Application Security Consortium. February 2008 [2008-07-04]. 
  6. ^ 6.0 6.1 6.2 Shiflett, Chris. Security Corner: Cross-Site Request Forgeries. php|architect (via shiflett.org). December 13, 2004 [2008-07-03]. 
  7. ^ US-CERT vulnerability list by severity metric
  8. ^ cPanel Remote Root
  9. ^ OpenCA CSRF
  10. ^ Adam Barth, Collin Jackson, and John C. Mitchell, Robust Defenses for Cross-Site Request Forgery, Proceedings of the 15th ACM Conference on Computer and Communications Security, ACM 2007
  11. ^ Jeremiah Grossman, Google YouTube crossdomain security flaw
  12. ^ Inferno Security Blog Brute-forcing CSRF tokens
  13. ^ Weaponizing Web 2.0
  14. ^ Dynamic CSRF
  15. ^ Owasp.org: Israel 2012/01: AJAX Hammer - Harnessing AJAX for CSRF Attacks
  16. ^ Downloads - hasc-research - hasc-research - Google Project Hosting. Code.google.com (2013-06-17). Retrieved on 2014-04-12.
  17. ^ Cross-Site Request Forgery: Demystified
  18. ^ Client access policy file to allow cross-domain access by Silverlight controls
  19. ^ Cross-domain policy file usage recommendations for Flash Player
  20. ^ Origin Header Proposal. People.mozilla.org. Retrieved on 2013-07-29.
  21. ^ Django 1.2.5 release notes. Django. 
  22. ^ Cross-Site Request Forgery (CSRF). OWASP, The Open Web Application Security Project. 4 September 2012 [11 September 2012]. 
  23. ^ Secunia Advisory SA22467. Secunia. 19 October 2006 [11 September 2012]. 
  24. ^ "Article about CSRF and same-origin XSS"

External links[编辑]

检索自“https://zh.wikipedia.org/w/index.php?title=User:Zhibinr/跨站请求伪造&oldid=30997434”