Everything You Wanted to Know About Client side CSRF But Were Afraid to Ask
summary
Claims that a new class of client-side CSRF can bypass traditional defenses and quantifies it with a working tool: JOE hybrid property graph crawls and models pages, combining static code, runtime snapshots and library summaries, and flags data flows from attacker-controlled inputs to request-senders. At scale it analyzes 106 apps (228M JS LOC), finds 12,701 forgeable requests, and produces proofs of concept for 203 requests across 7 apps. Analysis runs up to ~400s/page, libraries form ~60% of code, and SameSite or tokens do not stop these exploits.
AI-written summary · about
chapters (13)
- 0:00Intro
- 4:06Cross-Site Request Forgery (CSRF)
- 9:54Client-side CSRF: Problem Statement
- 11:34Static Analysis (to the Rescue)
- 13:17Static Analysis (Cont'd)
- 15:16Client-side CSRF: Exemplifying Detection Challenges
- 17:53Other General Challenges for CSRF
- 20:22JAW: Data Collection
- 22:52Hybrid Property Graphs (HPGs): Building Blocks
- 27:04HPGs: Symbolic Models and Semantic Types Propagation
- 30:24Vulnerability Analysis
- 36:04Evaluation: Forgeable Requests
- 44:32JAW: Scalability and Performance
related talks
46mNavigating The Landscape Of Client-Side Request Hijacking On The Web
28mOffensive and Defensive Strategies for Client-Side JS Security
38mExploiting Client-Side Path Traversal: CSRF Is Dead, Long Live CSRF
33mHacking The Front-End
42mHack Me If You Can
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
28mXSS, CSRF, CSP, JWT, Wtf? Idk
47mKeynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking