Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities

Abstract

Cross-Site Request Forgery (CSRF) is one of the oldest and simplest attacks on the Web, yet it is still effective on many websites and it can lead to severe consequences, such as economic losses and account takeovers. Unfortunately, tools and techniques proposed so far to identify CSRF vulnerabilities either need manual reviewing by human experts or assume the availability of the source code of the web application.In this paper we present Mitch, the first machine learning solution for the black-box detection of CSRF vulnerabilities. At the core of Mitch there is an automated detector of sensitive HTTP requests, i.e., requests which require protection against CSRF for security reasons. We trained the detector using supervised learning techniques on a dataset of 5,828 HTTP requests collected on popular websites, which we make available to other security researchers. Our solution outperforms existing detection heuristics proposed in the literature, allowing us to identify 35 new CSRF vulnerabilities on 20 major websites and 3 previously undetected CSRF vulnerabilities on production software already analyzed using a state-of-the-art tool.

Statically identifying XSS using deep learning

“…Like Code2vec, this prototype tried to predict method name by using an attention layer mechanism. Mitch (Calzavara et al, 2019) uses a browser extension HTTP-Tracker to manually label HTTP requests sent from web applications as sensitive or insensitive HTTP requests to detect CSRF attacks. The HTTP requests database was created by selecting Alexa ranking websites featuring authenticated access.…”

“…In order to prove this thesis, we compare and tweak for the XSS detection problem two different code representation techniques, based on natural language processing (Allamanis et al, 2016) (NLP) and programming language processing (Allamanis et al, 2018;Alon et al, 2019) (PLP), respectively, and use deep learning 6 for the detection of XSS vulnerabilities in code written in two mainstream web serverside languages: PHP 7 and Node.js 8 . Machine learning techniques have been previously applied to the detection of security vulnerabilities (e.g., (Li et al, 2018;Staicu et al, 2018;Calzavara et al, 2019;She et al, 2020)). .…”

An empirical comparison of commercial and open‐source web vulnerability scanners

“…44 Cross-Site-Request Forgery CSRF When the attacker sends an unauthenticated HTTP request to a user's browser intending to send information (such as the user's session cookie and other relevant information) to a web application. 60…”

Machine Learning Use Cases in Cybersecurity

“…For example, CSRF is found in only 5% of applications, as reported in the 2017 OWASP Top 10, because most frameworks include CSRF defences [29]. Accordingly, Calzavara et al presented Mitch [30], the first ML-based tool for the black-box detection of CSRF, which allows the identification of 35 new CSRF vulnerabilities on 20 websites from the Alexa Top 10,000 websites and three previously undetected CSRF vulnerabilities on production software already analyzed with the state-of-the-art tool Deemon [31]. Mitch is a binary classifier, labelling sensitive or insensitive requests using a random forest algorithm on a 49-dimensional feature space.…”

“…This section describes how an automated cyberattack can be carried out using ML. We considered two scenarios for the weaponization and delivery stages: First, in the case of humanless intrusion, attackers can use a similar tool but utilize information provided by Shodan [62] or Mitch [30] instead of features obtained using a computer vision. Second, attackers can use social engineering, using tools for profiling and for spear-phishing described in the previous section [34,35] and creating click-bytes links to infect the victim [35,36].…”