CWE-352
Compound Element ID:352(Compound Element Variant: Composite)
Status: Draft
NXTCgNGXgtH[WF
v
{Ǝ㐫݂ Web AvP[V́AtH[}bgɉAÓňѐ̂郊NGXgAM[ÜӐ}ʂɓnꂽ̂\ɌȂA邢͌s\łB
ڍׂȉ
Web T[oNGXgɎ悤vĂꍇAU҂NCAgxAӐ}ȂNGXg Web T[oɑM\܂B̏ꍇAWeb T[o͂̃NGXg𐳋K̂̂ƂĎ舵܂B
̍UURLA摜̓ǂݍ݁AXMLHttpRequest čsAf[^̘RӐ}ȂR[h̎s\܂B
ʖ
ZbVCfBO
NXTCgt@XtH[WF
XSRF
_Iȕ⑫
CSRF̃g|W[́ǍoHɓn܂B
1. U҂A郆[UɑāB͊ǑoHɂčp܂B
2. 郆[UA]ƂȂT[oɑāB̌oHɂčp܂B
Ǝ㐫̔
A[LeN`ѐv
YvbgtH[
Ɉˑ
WebT[o
ʓIȉe
| e͈ | e |
|---|---|
| @ S p |
ZpICpNgF̎擾Ȃ肷܂Ah䃁JjỶAAvP[Vf[^̓ǂݎ d含 CSRF ̐Ǝ㐫݂@\̐ɂĕς܂BU҂͎AQ҂Ɠ悤ɑsƂ\łBQ҂Ǘ҂邢͌̂郆[Uꍇɂ́Aweb AvP[V̊SȃRg[(f[^̍폜ގAĩACXg[ȋSẴ[UɑŮՂƂĂ̗p)^邱ƂɂȂ܂BU҂͔Q҂̎ʂĂ邽߁ACSRF ̋yԔ͈͔͂Q҂̎ɐ܂B |
U\
`
oi
蓮
{Ǝ㐫̓ylg[VeXgAЃfyю҂ANeBuZbVύXAL^łC^NeBuȃc[̂悤ȁA蓮́ilɂj͂KvƂZpƃc[ɂČo\łB
̓Iɂ́A蓮ɂ镪͖͂{Ǝ㐫̔ɗLłArWlXWbN𗝉ĂtH[X|WeBuŏ܂BAԓIȐ̒ŃR[hSĂ͂邱Ƃ͕s\ł傤BubN{bNX͂ɂēAJEg̏ȂꍇAAvP[VɂăZLeBłdvȕւ̔z\ł͂Ȃ\܂B
ݓIȖ肵A蓮͂ɖ𗧂 OWASP CSRFTester ̗p܂B
LF
蓮͂͊SɎꂽiʓIłBƎ㐫vyуrWlX[ɊWꍇɓɗLłB
ÓI
݂̂ƂACSRF ͎͂gpĂmɖhƂ͍łB́AeAvP[VꂼAỎe郊NGXgtÖق̃ZLeB|V[Ă邱ƁAyу[U쐬悤Ƃ郊NGXgɑ鍂Mv郊NGXgɑāA[ȖɎsĂ邱ƂłBႦAweb TCǧJɂL[[h́AʓIɃ[UNNbNƂɎIɎs郊NŃGR[h邱Ƃ҂Ă܂B
LFI
ƎȃR[h
1:
PHP ̃R[h́A[U̓eKȃZbVĂ邱ƂmF邱ƂɂAtH[̓eSɂ悤Ƃ̂łBAU҂͓KȃZbVłɕێĂ郆[U web uEŨNGXgU邽߁ACSRF U͂̑ł͖hƂł܂B ȉ HTML ̓[UɃvtB[̃Abvf[gs킹邽߂̂̂łB
Example Language: HTML (Bad Code)
<form action="/url/profile.php" method="post"> <input type="text" name="firstname"/> <input type="text" name="lastname"/> <br/> <input type="text" name="email"/> <input type="submit" name="submit" value="Update"/> </form>
profile.php ɂ́Aȉ̃R[h܂܂Ă܂B
Example Language: PHP (Bad Code)
// initiate the session in order to validate sessions
session_start();
//if the session is registered to a valid user then allow update
if (! session_is_registered("username")) {
echo "invalid session detected!";
// Redirect user to login page
[...]
exit;
}
// The user session is valid, so process the request
// and update the information
update_profile();
function update_profile {
// read in the data from $POST and send an update
// to the database
SendUpdateToDatabase($_SESSION['username'], $_POST['email']);
[...]
echo "Your profile has been successfully updated.";
}
ꌩAKȃZbVmFĂ邽߂̃R[h͕ی삳Ă悤Ɍ܂BACSRF U͎IɁAimage ^OANAߍ݂ object ^O ܂́AwiC[WĂяȏ̑܂߂ĂA^O HTML \s\łB
U҂́AWI web AvP[VɃOCĂԂɃy[WKꂽ郆[Ũ[U[AhXύXR[ĥ邱Ƃ\łB̃R[h͈ȉ̂悤ɖQ web y[WɌ܂B
ꂽ
| Q | ڍ |
|---|---|
| CVE-2004-1703 | Add user accounts via a URL in an img tag |
| CVE-2004-1995 | Add user accounts via a URL in an img tag |
| CVE-2004-1967 | Arbitrary code execution by specifying the code in a crafted img tag or URL |
| CVE-2004-1842 | Gain administrative privileges via a URL in an img tag |
| CVE-2005-1947 | Delete a victim's information via a URL or an img tag |
| CVE-2005-2059 | Change another users settings via a URL or an img tag |
| CVE-2005-1674 | Perform actions as administrator via a URL or an img tag |
| CVE-2009-3520 | modify password for the administrator |
| CVE-2009-3022 | CMS allows modification of configuration via CSRF attack against the administrator |
| CVE-2009-3759 | web interface allows password changes or stopping a virtual machine via CSRF |
Q̊ɘa
tF[YFA[LeN`ѐv
헪F CuAt[[N
{Ǝ㐫̔hA邢͖{Ǝ㐫₷\A\ɌꂽCut[[NgpĂB
ƂāAOWASP CSRFGuard ȂǂCSRFpbP[W܂B
̗ƂẮACSRF ɑR|[lg ESAPI Session Management control ܂B
tF[YF
CSRF ͍U҂̃XNvgɂ邽߁AAvP[VɃNXTCgXNveBO̖ (CWE-79) ƂmFĉB
tF[YFA[LeN`ѐv
ӂ̗tH[ɐAZbgAtH[闐ĂB
̗͐Ȃ̂ɂĉ (CWE-330).B
̊ɘa̓NXTCgXNveBOiCWE-79jɂ\ł邱ƂɒӂĂB
tF[YFA[LeN`ѐv
Ɋ댯ȏ肵ĂB[U댯ȏsꍇA[ȔӐ}Ă邩mFʂ̊mFNGXg𑗐MĂB
̊ɘa̓NXTCgXNveBOiCWE-79jɂ\ł邱ƂɒӂĂB
tF[YFA[LeN`ѐv
Felten Zeller ̒ "double-submitted cookie" \bhgpĉB
̎@ Javascript Kv邽߁AJavascript LłȂuEUɂ͌ʂ܂B
̊ɘa̓NXTCgXNveBOiCWE-79jɂ\ł邱ƂɒӂĂB
tF[YFA[LeN`ѐv
Ԃ̕ύXNSẴNGXgɂāAGET \bhgpȂʼnB
tF[YF
Ӑ}y[W烊NGXgMĂ邩mF邽߁AHTTP Referer wb_mFĉB[UvLVvCoV[̗R Referer ̑MɂĂ\邽߁A{̋@\ƂĈᔽ\܂B
̊ɘa̓NXTCgXNveBOiCWE-79jɂ\ł邱ƂɒӂĂBU҂̓NXTCgXNveBOɂāA[UɂȂ肷܂ Referer A邢 Referer ̋ꂽy[WAӂ̂郊NGXg\܂B
W
| Nature | Type | ID | Name | View(s) this relationship pertains to |
|---|---|---|---|---|
| Requires | Weakness Base | 346 | Origin Validation Error | Research Concepts1000 |
| Requires | Weakness Base | 441 | Unintended Proxy/Intermediary | Research Concepts1000 |
| Requires | Weakness Base | 613 | Unintended Proxy/Intermediary | Research Concepts1000 |
| Requires | Weakness Class | 642 | External Control of Critical State Data | Research Concepts1000 |
| ChildOf | Weakness Class | 345 | Insufficient Verification of Data Authenticity | Development Concepts (primary)699 |
| Research Concepts (primary)1000 | ||||
| ChildOf | Category | 716 | OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF) | Weaknesses in OWASP Top Ten (2007) (primary)629 |
| ChildOf | Category | 751 | 2009 Top 25 - Insecure Interaction Between Components | Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750 |
| ChildOf | Category | 801 | 2010 Top 25 - Insecure Interaction Between Components | Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors(primary)800 |
| ChildOf | Category | 814 | OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF) | Weaknesses in OWASP Top Ten (2010)(primary)809 |
| MemberOf | View | 635 | Weaknesses Used by NVD | Weaknesses Used by NVD (primary)635 |
| PeerOf | Weakness Base | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Research Concepts1000 |
W̕⑫
NXTCgXNveBOiXSSjɂACSRF \܂B
iKACSRF ̌ XSS łƂ͌܂Bj
v iCWE ̌j
肪ɂȂn߂ 2008 NO܂ł́ACVE ɂĉߏĂ܂ACSRF ͂قƂǂ Web AvP[Vɑ݂Ǝ㐫łB
gDł̕
| gD܂͑gDł̕ | m[h ID | CWE̕ނƂ̓Kx | ޖ |
|---|---|---|---|
| PLOVER | Cross-Site Request Forgery (CSRF) | ||
| OWASP Top Ten 2007 | A5 | Cross Site Request Forgery (CSRF) | |
| WASC | 9 | Cross-site Request Forgery |
֘AUp^[
| CAPEC-ID | Up^[ (CAPEC Version 1.5) |
|---|---|
| 62 | Cross Site Request Forgery (aka Session Riding) |
| 111 | JSON Hijacking (aka JavaScript Hijacking) |
Q
[REF-17] Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 2: Web-Server Related Vulnerabilities (XSS, XSRF, and Response Splitting)." Page 37. McGraw-Hill. 2010.
Peter W. "Cross-Site Request Forgeries (Re: The Dangers of Allowing Users to Post Images)".
Bugtraq. <http://marc.info/?l=bugtraq&m=99263135911884&w=2>.
OWASP. "Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet". <http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet>.
Edward W. Felten and William Zeller. "Cross-Site Request Forgeries: Exploitation and Prevention". 2008-10-18. <http://freedom-to-tinker.com/sites/default/files/csrf.pdf>.
Robert Auger. "CSRF - The Cross-Site Request Forgery (CSRF/XSRF) FAQ". <http://www.cgisecurity.com/articles/csrf-faq.shtml>.
Cross-site request forgery. Wikipedia. 2008-12-22. <http://en.wikipedia.org/wiki/Cross-site_request_forgery>.
Jason Lam. "Top 25 Series - Rank 4 - Cross Site Request Forgery". SANS Software Security Institute. 2010-03-03. <http://blogs.sans.org/appsecstreetfighter/2010/03/03/top-25-series-%E2%80%93-rank-4-%E2%80%93-cross-site-request-forgery/>.
XV
[2011N0421]
2010N1012_̃f[^ɍXV
[2009N0629]
2009N0202_̉L URL ɍ쐬
http://cwe.mitre.org/data/definitions/352.html
o^ 2011/04/21
ŏIXV 2023/04/04
