What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

Question

According to techtarget.com Cross-Site Request Forgery is:

a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to modify firewall settings, post unauthorized data on a forum or conduct fraudulent financial transactions. A compromised user may never know that such an attack has occurred. If the user does find out about an attack, it may only be after the damage has been done and a remedy may be impossible.

An example of a Cross-Site Request Forgery bug within Android O.S

App Name

Wireless File Transfer Pro Android - CSRF Vulnerabilities

Vulnerability Details

Multiple cross site request forgery issues has been discovered in the Wireless File Transfer Pro 1.0.1 android mobile web-application. The mobile web-application is vulnerable to a combination of cross site request forgery and local command injection attacks.

Security Risk

The security risk of the cross site request forgery web vulnerability in the create and delete function is estimated as medium. (CVSS 2.3)

References (Source)

http://www.vulnerability-lab.com/get_content.php?id=1437

My Question

What makes an android application vulnerable to Cross-Site Request Forgery, as although I've seen and understand its use when used against regular websites. I don't understand what factors make Android application code vulnerable to Cross-Site Request Forgery attacks.

Answer 1

An Android client application should not be vulnerable to CSRF attacks (except for a browser application like Chrome, but it is not the application here that is vulnerable, it is the website being browsed).

This is because for an CSRF to succeed, the client needs to be able to send cookies to the vulnerable website. An Android application would only access web services for its own functionality. It should not be possible to view arbitrary websites from within the app in order to visit a malicious website that would trigger any CSRF vulnerability. If there was browsing functionality, the cookies stored for browsing would likely be different to the cookies the app uses to communicate with any API web service. If not, then see above ("it is not the application here that is vulnerable, it is the website being browsed").

In the case of "Wireless File Transfer Pro" it appears that this is not an Android client application, it is a server application running on Android. I'm taking a wild guess that this application allows you to access your phone's content via a web browser over the local network because the example exploit uses a private IP address:

<img src="http://192.168.1.2:8888/fileExplorer.html?action=deleteFile&fileName=test""width="0" height="0" border="0">

The report is saying that the Android hosted web application is vulnerable to CSRF in the same way that a public website would be vulnerable.