While Pentesting through some sites i found that an Multiple account's can be created using same CSRF token which should not allowed.I want to place two scenario's to describe my question.

Scenario 1:- Multiple account's can be created on the site with same CSRF token and there is no need to verify the account for using it i.e once password and email are entered ,you can directly start using your account.

Scenario 2:- In this site also multiple account's can be created but user have to verify the email address to actually start using the account.

From above we can clearly see that First Website is posing a great security risk.So,my question is "Can Scenario 2 can also create some risk to the website "?

  • 3
    Why do you say that scenario 1 "..is posing a great security risk?" CSRF protection is primarily to protect against an attacker performing an action on behalf of an authenticated victim. Creating an account is an action that would ostensibly be taken by an unauthenticated user, and creates a new user context, so it shouldn't be at significant risk for CSRF. – Xander Apr 5 '14 at 17:54
  • @Xander, depending on the situation this may be an issue because the IP-address in the server log files will not point to the attacker but to the victim. This is assuming that the CSRF token is not logged. For example an attacker is able to frame a victim by letting his browser create an account and access some illegal information (e. g. copyright violation or worse). – Hendrik Brummermann Apr 7 '14 at 14:40

First, CSRF protection is not a part of the problem or solution here, you're just overloading the term to be synonymous with session. As I pointed out in my comment, CSRF protection is primarily to protect against an attacker performing an action on behalf of an authenticated victim. Account creation (in most cases) is an action performed by an unauthenticated user. You don't typically let an authenticated user create an account at all, CSRF or no CSRF. (Membership management interfaces are out of scope for this discussion.)

The bottom line question I see here, is "Does it matter if a single browser session creates multiple accounts, if email verification is a part of the user creation process?"

The answer is, it depends, but probably not. What's important is, what threats are you trying to protect against?

Automated spam user creation? In that case, it probably doesn't matter. It's easy enough for a bot to throw away session cookies and they typically don't follow through with an email verification process.

If you're trying to protected against unsophisticated human spammers, it might offer a bit of additional protection. Not much, but a little. However, I'd say that this is true for your scenario 1 as well. Even without email verification, there's not really much to be gained here, in terms of security. You'll get, by far, the most additional protection from email validation (and other additional measures, like a captcha, or throttling the number of accounts that can be created by a single IP address) and very little from attempting to limit the number of users created by a browser session.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.