Description

Detects when CSRF (Cross-Site Request Forgery) protection is explicitly disabled in ASP.NET Core MVC applications through the [IgnoreAntiforgeryToken] attribute on controller endpoints. This creates a security risk by removing built-in anti-forgery token validation, making the application vulnerable to CSRF attacks where malicious sites can trigger unauthorized actions on behalf of authenticated users.

Detection Strategy

• Check if Microsoft.AspNetCore.Mvc namespace is imported in the source code

• Look for controller action methods (endpoints) in the application

• Identify methods decorated with [IgnoreAntiforgeryToken] attribute

• Report a vulnerability when the IgnoreAntiforgeryToken attribute is found on any controller endpoint method

Vulnerable code example

using Microsoft.AspNetCore.Mvc;

public class AccountController : Controller
{
    [HttpPost]
    [IgnoreAntiforgeryToken]  // Vulnerable: Disables CSRF protection on POST endpoint
    public IActionResult UpdateProfile(string email)
    {...

✅ Secure code example

using Microsoft.AspNetCore.Mvc;

public class AccountController : Controller
{
    [HttpPost]
    [AutoValidateAntiforgeryToken]  // Added CSRF protection by requiring antiforgery token validation
    public IActionResult UpdateProfile(string email)
    {...