0

A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and eliminate the security alert? Is this something mailchimp need to provide a fix for?

  • does your website do anything, or just serve static pages? if it's all static, there's no risk. If there's active server processing, it may have a problem. I would not worry about a major provider like mailchimp causing a problem for you; that will be on mailchimp to address. – dandavis Mar 7 '19 at 18:46
  • Did you enabled recaptcha? mailchimp.com/help/about-recaptcha-for-signup-forms – Hugo Dias Mar 7 '19 at 19:25
  • 4
    Not every finding by an automated tool is going to be legitimate. – Daisetsu Mar 7 '19 at 19:26
  • it is asp.net mvc website. Mailchimp form embed with 2 fields is just for newletter subscription. we don't have recaptcha. the alert is for CSRF. we are looking for a mailchimp embed fix like this: craftcms.stackexchange.com/questions/22139/… – vrkmajeti Mar 8 '19 at 1:07
1

One of the pre-requisites for a successful CSRF attack is that the user should be authenticated already. From your question, it doesn't seem like the user is authenticated on that page.

In CSRF you forge an authenticated users request to submit some form data to make state change in the application.

There is a special case of CSRF on login pages, which is Login CSRF. In this, you make the user login with your own credentials to track the users activities. Suppose you are trying to attack an e-commerce application, you can make the user to login using your own dummy username and password. When the user later on pays for something online, they may unknowingly add their credit card to your/attacker's account. This case may be applicable to you.

In any case, the fix should be at 'mailchimps' end as they are the ones validating login info. Hence, embedding and validating the CSRF token should be performed by them.

It would be helpful to answer more accurately if you can provide details on the features that your application provides.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.