跨站请求伪造

诱导已登录的用户在不知情的情况下发出请求。SameSite 默认值改变后数量下降，但 JSON 接口、GET 改状态和登录 CSRF 依然常见。

影响

以受害者身份修改账户设置、绑定攻击者控制的邮箱或执行转账等敏感操作

观察点

受害者账户的状态被修改，而服务端没有校验请求来源

修复

为所有改变状态的请求校验 CSRF Token，设置 SameSite=Lax/Strict Cookie，并校验 Origin / Referer。

弱点分布

• 跨站请求伪造511
• Unlabeled8

共现类别

暂无共现数据。

高票报告

当前状态 346 份 · 全部 519 · 筛选赏金 $62,428

1. 366
   [CSRF] TikTok Careers Portal Account TakeoverTikTok · 2020-12-15 · 高危
   $0跨站请求伪造
2. 304
   CSRF on connecting Paypal as Payment ProviderShopify · 2020-04-10 · 中危
   $0跨站请求伪造
3. 238
   Account Takeover using Linked Accounts due to lack of CSRF protectionRockstar Games · 2019-02-20 · 高危
   $0跨站请求伪造
4. 224
   Periscope android app deeplink leads to CSRF in follow actionX / xAI · 2020-02-22 · 低危
   $1,540跨站请求伪造
5. 184
   Take over of accounts created using Google or FacebookKhan Academy · 2019-05-17 · 严重
   $0跨站请求伪造
6. 168
   Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneHackerOne · 2023-06-20 · 高危
   $0跨站请求伪造
7. 152
   CSRF protection bypass in GitHub Enterprise management consoleGitHub · 2022-04-14 · 高危
   $10,000跨站请求伪造
8. 149
   Slack integration setup lacks CSRF protectionHackerOne · 2021-07-07 · 高危
   $2,500跨站请求伪造
9. 116
   SocialClub Account Take Over Through Import Friends featureRockstar Games · 2021-04-01 · 高危
   $0跨站请求伪造
10. 113
    CSRF token validation system is disabled on Stripe DashboardStripe · 2022-04-02 · 中危
    $0跨站请求伪造
11. 112
    Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.Rockstar Games · 2020-06-25 · 中危
    $0跨站请求伪造
12. 111
    Cross-Site Request ForgeryownCloud · 2023-11-05 · 高危
    $0跨站请求伪造
13. 111
    Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversKhan Academy · 2019-06-22 · 高危
    $0跨站请求伪造
14. 104
    CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/Rockstar Games · 2020-06-12 · 中危
    $0跨站请求伪造
15. 99
    Account takeover due to insufficient URL validation on RelayState parameterGitLab · 2023-05-30 · 中危
    $2,450跨站请求伪造
16. 99
    One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comLogitech · 2021-01-06 · 中危
    $0跨站请求伪造
17. 95
    CSRF Account TakeoverTikTok · 2022-08-17 · 高危
    $0跨站请求伪造
18. 95
    CSRF to HTML Injection in CommentsWordPress · 2019-05-14 · 高危
    $0跨站请求伪造
19. 92
    CSRF in Account Deletion feature (https://www.flickr.com/account/delete)Flickr · 2021-09-15 · 高危
    $0跨站请求伪造
20. 89
    Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo accountDiscourse · 2018-12-06 · 高危
    $0跨站请求伪造
21. 88
    CSRF on /api/graphql allows executing mutations through GET requestsGitLab · 2021-08-03 · 高危
    $3,370跨站请求伪造
22. 88
    [CRITICAL] Full account takeover using CSRFX / xAI · 2017-11-03 · 高危
    $0跨站请求伪造
23. 87
    CSRF leads to Account takeoverU.S. Dept Of Defense · 2024-12-19 · 高危
    $0跨站请求伪造
24. 87
    CSRF token validation system is disabled on Stripe DashboardStripe · 2022-06-01 · 中危
    $2,500跨站请求伪造
25. 84
    Login CSRF vulnerability on hackerone.comHackerOne · 2020-06-13 · 低危
    $500跨站请求伪造