sc-csrf

SC: Cross-Site Request Forgery (CSRF)

Purpose

Detects CSRF vulnerabilities where state-changing operations (POST, PUT, DELETE) lack CSRF protection, enabling attackers to trick authenticated users into performing unintended actions. Covers missing CSRF tokens, SameSite cookie misconfiguration, token validation flaws, and JSON content-type bypass scenarios.

Activation

Called by sc-orchestrator during Phase 2 when web applications with session-based auth are detected.

Phase 1: Discovery

Keyword Patterns to Search

"csrf", "CSRF", "csrftoken", "csrf_token", "_token",
"SameSite", "samesite", "X-CSRF-Token", "X-XSRF-TOKEN",
"@csrf", "csrf_exempt", "CsrfViewMiddleware",
"antiforgery", "ValidateAntiForgeryToken", "csurf"

Vulnerability Patterns

1. Missing CSRF Protection:

# VULNERABLE: State-changing endpoint without CSRF
@csrf_exempt  # Explicitly disabled!
def transfer_funds(request):
    amount = request.POST['amount']
    to_account = request.POST['to']
    # Transfer without CSRF verification

2. SameSite Cookie Not Set:

// VULNERABLE: No SameSite attribute
app.use(session({
  cookie: { httpOnly: true, secure: true }
  // Missing: sameSite: 'strict' or 'lax'
}));

3. JSON API Without Content-Type Validation:

// VULNERABLE: Accepts both form-encoded and JSON
app.post('/api/transfer', (req, res) => {
  // Attacker can submit via HTML form with content-type application/x-www-form-urlencoded
});

// SAFE: Require application/json content-type
app.post('/api/transfer', (req, res) => {
  if (req.headers['content-type'] !== 'application/json') {
    return res.status(415).send('Unsupported Media Type');
  }
});

Framework CSRF Defaults

• Django: CSRF middleware enabled by default. Check for @csrf_exempt.
• Laravel: VerifyCsrfToken middleware. Check $except array.
• Spring Security: CSRF enabled by default. Check .csrf().disable().
• Express: No built-in CSRF. Check for csurf or csrf-csrf middleware.
• ASP.NET: Check for [ValidateAntiForgeryToken] on POST actions.