What is CWE-352: Cross-Site Request Forgery (CSRF)?+
CWE-352: Cross-Site Request Forgery (CSRF) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Is CWE-352 in the CWE Top 25 Most Dangerous Software Weaknesses?+
Yes. CWE-352 ranked #5 in the CWE Top 25 for 2024, associated with 345 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.
What are the security consequences of Cross-Site Request Forgery (CSRF)?+
If exploited, CWE-352 (Cross-Site Request Forgery (CSRF)) it can compromise Confidentiality, Integrity, Availability, Non-Repudiation and Access Control, leading to outcomes such as Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data and DoS: Crash, Exit, or Restart.
How do you prevent or mitigate Cross-Site Request Forgery (CSRF)?+
Recommended mitigations for CWE-352 include: Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script. Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332] Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
How is Cross-Site Request Forgery (CSRF) detected?+
CWE-352 can be detected using Automated Static Analysis, Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation and Manual Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Cross-Site Request Forgery (CSRF)?+
CWE-352 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Cross-Site Request Forgery (CSRF)?+
MITRE documents real CVEs mapped to CWE-352, including CVE-2004-1703, CVE-2004-1995, CVE-2004-1967, CVE-2004-1842 and CVE-2005-1947. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-352 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.