Poisoned Pipeline / Techniques / T0188
Cross Site Request Forgery
Code Security
Cross-Site Request Forgery, or CSRF, may have different affects, depending on the application code.
It is widely used in conjunction with spear-phishing attacks where adversaries will attempt to abuse authenticated users sessions to perform actions that will allow them to take over a server.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://www.securityweek.com/csrf-vulnerability-kudu-scm-allowed-code-execution-azure-services/
- https://owasp.org/www-community/attacks/csrf
Mitigations
- M1720 Implement regular patches and updates
- M1880 Implement Anti-CSRF token
- M1881 Enable SameSite cookies
- M1882 Implement Strict Referer Policy
- M1883 Implement Web Application Firewall
Detections
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1171 Implement Web Application Firewall
- D1880 Missing Anti-CSRF token
- D1881 Missing Referer header
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.