We've recently had one of our webapps pentested. All went well, except for a CSRF vulnerability, and it is this finding I have a bone to pick with.
Some background: we're using ASP.NET MVC and, among other things, we do use the CSRF protection functionality built into it. The way it works is strictly in accordance with what OWASP recommends: by including so-called "synchronizer tokens", one in a HTTP cookie, and another in a hidden input named
<form action="/Home/Test" method="post"> <input name="__RequestVerificationToken" type="hidden" value="6fGBtLZmVBZ59oUad1Fr33BuPxANKY9q3Srr5y[...]" /> <input type="submit" value="Submit" /> </form>
We also do regular Acunetix scans, and said scans never found any CSRF-unprotected forms.
Now, what the pentesters claim is that they were able to "breach" our CSRF protection with the following code:
<html> <body> <form action="https://our.site/support/discussions/new" method="POST"> <input type="hidden" name="subject" value="Subject" /> <input type="hidden" name="content" value="Content" /> <input type="hidden" name="__RequestVerificationToken" value="_e-upIZFx7i0YyzrVd[...]" /> <input type="submit" value="Submit Request" /> </form> </body> </html>
The inclusion of the
__RequestVerificationToken field is what bothers me the most: to me, it is akin to claiming that an attacker has transferred gazillion dollars from my bank account because I voluntarily gave him my iPhone to fiddle with, and he saw the one-time password that my bank sent in an SMS.
I imagine that the only way this attack could potentially work is if we were not using HTTPS, were vulnerable to XSS, were using non-HTTP-only cookies and were negligent with a Same Origin Policy. None of which is true, since none of these vulnerabilities were reported by either pentesters or Acunetix.
So the question is: am I wrong and this is a legit CSRF vulnerability or is it not?