OWASP defines Cross-Site Request Forgery (CSRF) as
an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
An example of attack is the link
http://example.com/logout sent to an authenticated user who, upon clicking it, is logged out. We managed to change the state of the system (in that case - user login) by making the user click on a link we provided him.
Now imagine a voting system where everyone can vote, no matter whether they are authenticated or not. The system does not keep track of who voted (which is on itself obviously an issue).
I can replay without limitations HTTP calls which will increase the voting counter. Would sending that replay link to someone else who would (without being logged in) click on it and increase the voting counter be considered as an CSRF vulnerability?
My opinion is that this is not a CSRF because:
- we lack the "authenticated" part of the definition (that would be for the semantics)
- I believe that the intent of this classification was to highlight that an attacker can make you execute commands he otherwise could not do (because you need to be authenticated). The case of the non-authenticated vote above is IMO better described by A4 (Broken Access Control)