Examkin

Question

Difficulty: EasyApplication and Software Vulnerabilities

A security analyst is reviewing an assessment report for a web application that identified a Cross-Site Request Forgery (CSRF) vulnerability in a user profile management module. Which of the following strategies directly mitigate this specific vulnerability? (Select TWO).

  1. Utilizing unique anti-CSRF synchronizer tokens validated on all state-changing requestsAnswer
  2. Configuring session cookies with the SameSite attribute set to Strict or LaxAnswer
  3. C
    Enforcing multi-factor authentication (MFA) during the initial user login process
  4. D
    Applying parameterized SQL database queries for user search inputs

Answer

The strategies that directly mitigate Cross-Site Request Forgery (CSRF) are utilizing unique anti-CSRF synchronizer tokens validated on state-changing requests, and configuring session cookies with the SameSite attribute set to Strict or Lax.
Cross-Site Request Forgery (CSRF) leverages an existing authenticated browser session to execute unintended commands. Implementing unique anti-CSRF synchronizer tokens ensures that state-changing requests include a secret, unpredictable value that an attacker cannot forge. Setting the SameSite attribute (Strict or Lax) on session cookies provides additional defense-in-depth by preventing the browser from automatically sending authentication cookies with cross-site requests.

Step-by-Step Solution

1
Identify the nature of Cross-Site Request Forgery (CSRF).
CSRF occurs when an attacker tricks an authenticated user's web browser into executing unauthorized, state-changing actions on a trusted web application.
Understanding the attack vector helps select controls that validate request origin and intentionality.
2
Evaluate mitigation controls designed to verify request origin.
Anti-CSRF synchronizer tokens provide a secret, unpredictable value bound to the session that third-party sites cannot read, and SameSite cookie policies instruct browsers to suppress session cookies during cross-site requests.
Both controls ensure cross-site malicious forms cannot successfully submit state-changing requests using the victim's ambient credentials.

Key Concept

Cross-Site Request Forgery (CSRF) Prevention
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic