Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

An IBM Rational AppScan against a WSS 3.0 installation indicates that it has detected a cross-site request forgery (CSRF/XSRF) vulnerabilities on many pages, for example _layouts/AddContentTypeToList.aspx, _layouts/ManageFeatures.aspx, and _layouts/RecycleBin.aspx. I am trying to determine if these are somehow false positives. Unfortunately, AppScan is not very verbose about how it performs this test.

Searching on the internet, I see lots of pages that mention SPUtility.ValidateFormRequest(), which apparently verifies a token found in a hidden "canary" __REQUESTDIGEST field, which can be created with a SharePoint:FormDigest tag in an application page. This guidance seems to always be presented in very vague terms. For example, this page http://acveer.wordpress.com/2011/06/22/prevent-csrf-cross-site-request-forgery-attacks-in-sharepoint-application-pages/ says that you should "use SharePoint FormDigest Control" to "prevent CSRF attacks in SharePoint application pages." Does that mean I need to do this only in custom application pages, or do I need to modify the out-of-the box page layouts or master pages in order to get this protection? I think the canary value is already present on every page, so does SharePoint check it automatically, and if so, why does AppScan indicate that CSRF is present?

share|improve this question
    
It is somewhat unusual to do this type of test using an account with such high permissions. Normally it is done using the common level of permissions to a site, such as 'Contributor' –  Dave Wise Mar 25 '13 at 15:58
1  
@DaveWise Thanks. Even if I do this with a lowly-privileged account, it will have access to pages like RecycleBin.aspx. In any case I think CSRF is a concern even if only highly-privileged accounts could be victimized. –  J T Mar 25 '13 at 16:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.