AWS Security Stories #04.1: OWASP - CSRF

CSRF, or Cross-Site Request Forgery, is a type of attack that tricks a user into making unauthorized requests to a web application. This can be done by tricking the user into clicking a link, visiting a website, or even just viewing an image. Here are five examples of CSRF attacks:

- Link injection: In this type of attack, the attacker injects a malicious link into a website that the user is known to visit. When the user clicks on the link, it will perform an action on the target web application, such as transferring money from the user's account to the attacker's account.

<a href="http://example.com/transfer?amount=1000&to=attacker">Click here for a prize!</a>

- Form submissions: In this type of attack, the attacker creates a form that looks legitimate and tricks the user into submitting it. This can cause the form to perform an action on the target web application, such as changing the user's password or email address.

<form action="http://example.com/change-password" method="post">
    <input type="hidden" name="password" value="attacker_password">
    <input type="submit" value="Change password">
</form>

- Image tag: In this type of attack, the attacker uses an image tag to load an image from a different website. This can cause the target web application to perform an action, such as transferring money or changing the user's password.

<img src="http://example.com/transfer?amount=1000&to=attacker">

- CSRF token stealing: in this type of attack, the attacker is trying to steal CSRF token from the target website using various techniques such as xss, browser's dev tool, or phishing email. Then the attacker could use that token to create a fake request and execute it.

<script>
    var csrf_token = document.getElementsByName("csrf_token")[0].value;
    var xhr = new XMLHttpRequest();
    xhr.open("POST", "http://example.com/transfer");
    xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
    xhr.send("amount=1000&to=attacker&csrf_token=" + csrf_token);
</script>

- Social Engineering: In this type of attack, the attacker tricks the user into visiting a website or clicking a link that contains a CSRF exploit. For example, the attacker could send an email to the user that looks like it's from their bank, and ask the user to click a link to update their account information.

<a href="http://example.com/transfer?amount=1000&to=attacker">
    Click here to update your account information
</a>

It's important to note that CSRF attacks exploit the trust a website has in a user's browser, by using the user's browser to send a malicious request to the website, with all the necessary authentication cookies, etc. To prevent CSRF, web applications can include a unique token in each form and validate it on the server side.

When it comes to AWS, AWS WAF can be used to protect against CSRF attacks by configuring rules that check for the presence of a CSRF token in the requests. Additionally, Amazon S3 and Amazon CloudFront can be configured to use the Same-Site cookie attribute to prevent cookies from being sent with cross-site requests. AWS Elastic Beanstalk and AWS Amplify also provide a way to protect against CSRF, by adding a security middleware to the web application framework.

Ways to protect against CSRF attacks on AWS:

1. Amazon Web Application Firewall (AWS WAF): This service allows you to configure rules that check for the presence of a CSRF token in the requests and block requests that do not have the token. Additionally, AWS WAF provides predefined rules to help protect against common web application attacks, such as SQL injection, cross-site scripting (XSS), and common exploits.

2. Amazon S3 and Amazon CloudFront: These services can be configured to use the Same-Site cookie attribute to prevent cookies from being sent with cross-site requests. By default, Amazon S3 and Amazon CloudFront don't send cookies in responses, but the Same-Site attribute can be set through the origin response header or response header override feature of CloudFront.

3. AWS Elastic Beanstalk: This platform-as-a-service (PaaS) makes it easy to deploy and run web applications and services. It includes a security middleware that can protect against CSRF attacks by adding a CSRF token to forms and validating the token on the server-side.

4. AWS Amplify: This service makes it easy to develop, deploy, and host web and mobile applications. It includes a security middleware that can protect against CSRF attacks by adding a CSRF token to forms and validating the token on the server-side, similar to AWS Elastic Beanstalk.

5. AWS App Runner: this service allows you to run and deploy containerized applications, it can use managed security groups to control the inbound and outbound traffic between services, which could provide another layer of protection to the application against CSRF attack.

It's important to note that while these methods can provide protection against CSRF attacks, they should be used in conjunction with other security measures, such as encryption and authentication, to provide a comprehensive defense against web application attacks.