跨站请求伪造

诱导已登录的用户在不知情的情况下发出请求。SameSite 默认值改变后数量下降，但 JSON 接口、GET 改状态和登录 CSRF 依然常见。

影响

以受害者身份修改账户设置、绑定攻击者控制的邮箱或执行转账等敏感操作

观察点

受害者账户的状态被修改，而服务端没有校验请求来源

修复

为所有改变状态的请求校验 CSRF Token，设置 SameSite=Lax/Strict Cookie，并校验 Origin / Referer。

弱点分布

• 跨站请求伪造511
• Unlabeled8

共现类别

暂无共现数据。

高票报告

当前状态 519 份 · 全部 519 · 筛选赏金 $66,828

1. 653
   My Expense Report resulted in a Server-Side Request Forgery (SSRF) on LyftLyft · — · 未评级
   $0Unlabeled
2. 366
   [CSRF] TikTok Careers Portal Account TakeoverTikTok · 2020-12-15 · 高危
   $0跨站请求伪造
3. 304
   CSRF on connecting Paypal as Payment ProviderShopify · 2020-04-10 · 中危
   $0跨站请求伪造
4. 238
   Account Takeover using Linked Accounts due to lack of CSRF protectionRockstar Games · 2019-02-20 · 高危
   $0跨站请求伪造
5. 224
   Periscope android app deeplink leads to CSRF in follow actionX / xAI · 2020-02-22 · 低危
   $1,540跨站请求伪造
6. 184
   Take over of accounts created using Google or FacebookKhan Academy · 2019-05-17 · 严重
   $0跨站请求伪造
7. 168
   Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneHackerOne · 2023-06-20 · 高危
   $0跨站请求伪造
8. 162
   Site wide CSRF affecting both job seeker and Employer account on glassdoor.comGlassdoor · — · 未评级
   $0跨站请求伪造
9. 152
   CSRF protection bypass in GitHub Enterprise management consoleGitHub · 2022-04-14 · 高危
   $10,000跨站请求伪造
10. 149
    Slack integration setup lacks CSRF protectionHackerOne · 2021-07-07 · 高危
    $2,500跨站请求伪造
11. 116
    SocialClub Account Take Over Through Import Friends featureRockstar Games · 2021-04-01 · 高危
    $0跨站请求伪造
12. 113
    CSRF token validation system is disabled on Stripe DashboardStripe · 2022-04-02 · 中危
    $0跨站请求伪造
13. 112
    Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.Rockstar Games · 2020-06-25 · 中危
    $0跨站请求伪造
14. 111
    Cross-Site Request ForgeryownCloud · 2023-11-05 · 高危
    $0跨站请求伪造
15. 111
    Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversKhan Academy · 2019-06-22 · 高危
    $0跨站请求伪造
16. 104
    CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/Rockstar Games · 2020-06-12 · 中危
    $0跨站请求伪造
17. 99
    Account takeover due to insufficient URL validation on RelayState parameterGitLab · 2023-05-30 · 中危
    $2,450跨站请求伪造
18. 99
    One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comLogitech · 2021-01-06 · 中危
    $0跨站请求伪造
19. 95
    CSRF Account TakeoverTikTok · 2022-08-17 · 高危
    $0跨站请求伪造
20. 95
    CSRF to HTML Injection in CommentsWordPress · 2019-05-14 · 高危
    $0跨站请求伪造
21. 92
    CSRF in Account Deletion feature (https://www.flickr.com/account/delete)Flickr · 2021-09-15 · 高危
    $0跨站请求伪造
22. 89
    Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo accountDiscourse · 2018-12-06 · 高危
    $0跨站请求伪造
23. 88
    CSRF on /api/graphql allows executing mutations through GET requestsGitLab · 2021-08-03 · 高危
    $3,370跨站请求伪造
24. 88
    [CRITICAL] Full account takeover using CSRFX / xAI · 2017-11-03 · 高危
    $0跨站请求伪造
25. 87
    CSRF leads to Account takeoverU.S. Dept Of Defense · 2024-12-19 · 高危
    $0跨站请求伪造