Cross-Site Request Forgery
Medium · Session
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-352
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-352
Definition
Victim's browser is tricked into sending authenticated requests.
Root cause
State-changing requests rely only on cookies.
Affected components
- Components in the “Session” class
- Application / API handlers
- Supporting libraries
Impact
Unwanted actions as the victim.
Severity
Medium
Safe lab reproduction
DVWA CSRF module
Detection methodology
Review state-changing endpoints for tokens/SameSite.
Evidence examples
- Lab reproduction notes: DVWA CSRF module
- Request/response excerpts (redacted)
- Detection signal: Review state-changing endpoints for tokens/SameSite
Remediation
CSRF tokens, SameSite cookies, re-auth for sensitive actions.
Secure coding examples
Use framework CSRF protection; set SameSite=Lax or Strict.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.