Description

This vulnerability detector identifies JavaScript AJAX requests that lack proper Cross-Site Request Forgery (CSRF) protection mechanisms. CSRF attacks can force authenticated users to perform unintended actions on web applications, potentially leading to unauthorized data modification, account takeover, or privilege escalation.

Detection Strategy

• Scans JavaScript code for AJAX function calls

• Analyzes each AJAX request to determine if it performs state-changing operations (POST, PUT, DELETE, PATCH methods)

• Checks if CSRF protection is missing by verifying the absence of:

• - CSRF tokens in request headers (X-CSRF-Token, X-CSRFToken, etc.)

• - CSRF tokens in request body parameters

• - CSRF tokens in form data being submitted

• Reports vulnerability when state-changing AJAX requests are found without any CSRF token validation mechanism

Vulnerable code example

// VULNERABLE: CSRF token extracted from untrusted source
const token = document.referrer.split('csrfToken=')[1];
$.ajax({
    url: '/api/create-post',
    method: 'POST',
    headers: {
        'X-CSRF-Token': token // Attacker can control referrer value
    }...

✅ Secure code example

// SECURE: CSRF token from trusted server-side source
const token = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
$.ajax({
    url: '/api/create-post',
    method: 'POST',
    headers: {
        'X-CSRF-Token': token // Token from server-controlled meta tag
    }...