AYSabre (Community Member) asked a question.
I don't understand why the constructor is getting flagged for a CSRF flaw. We do have an interface that can be injected for unit testing and by Unity but these aren't accessible to any external requests on the related endpoints. How do we mitigate this? Thank you.
Hi @AYSabre (Community Member) ,
Unfortunately, it's difficult to say what the best course of action is without more details.
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
In the case please mention a URL to the results wherein the flaw can be found (typically something like: https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsAllFlaws:.. ) and the flaw id.
Thank you,
Boy Baukema
For others that want to know more about the remediation for CWE 352 Cross-Site Request Forgery (CSRF) in .NET, Veracode Static Analysis reports this in a number of circumstances, in this case it saw several methods with the HttpPost attribute in a class extending from Microsoft.AspNetCore.Mvc.ControllerBase and did not see one of the following remediations:
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
...
services.AddMvc(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute())) //Will suppress all CSRF issues in Controllers.
.SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
...
}
Alternatively you can annotate your class as an [ApiController] as described in the Microsoft documentation: https://docs.microsoft.com/en-us/aspnet/core/web-api/?view=aspnetcore-3.1 .
Also please ensure before you review flaws that the application has been compiled per our Compilation Guide for .NET ( https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/UWyzuOKNbFbwQACRLkZVjA ) and ensure you are publishing your project with debug symbols (Debug profile).
Thank you,
Boy Baukema
Thanks for the info but we already have all our controllers decorated with [ApiController]. This is a WebApi resource so no forms are used with nonce so no anti forgery token is used. Only two controllers are getting flagged at the contructor. Still not sure why those controllers but I have an on-going support ticket going so hopefully we can figure it out.
It appears you have a base controller with [ApiController].
Veracode Static Analysis currently does not check base classes for attributes.
Please consider registering your idea with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema
This was very helpful. It was not obvious that Veracode could not detect the ApiController attribute in a base class and it only flagged a controller that had an HttpPost route. In addition to the CSRF (CWE 352), it also flagged the route with CWE 915 (Improperly Controlled Modification of Dynamically-Determined Object) which was also cleared up after decorating the class with the ApiController attribute.
I'm happy to report that, thanks to your submission for Community Ideas, starting with our '21 November release we will be supporting detection of [ApiController] on parent classes.
To stay up-to-date on our product releases please consider subscribing to our Product Updates at: https://info.veracode.com/Subscription-Management.html
Thank you,
Boy Baukema
Is the only way to remediate this "flaw" for an HTTPPost endpoint is to add ApiController attribute for a method in a controller.
My problem is that this controller is not only used for API endpoints. I can't add this attribute, and I can't add ValidateAntiForgeryToken attribute to the method because this endpoint is not invoked by a form submission. I have to use HTTPPost because I'm following a spec.
Are there no other choices to let the Veracode scanners know what the intent is.
Also, please put the flaw on that actual method, not the constructor as that doesn't make any sense.
Hi @RSlaney735289 (Community Member) ,
The only facility Veracode Static Analysis currently supports for relaying intent are Custom Cleansers ( https://help.veracode.com/r/customcleansers ) which work by automatically proposing a mitigation (depending on the configuration for your organization: https://help.veracode.com/r/c_cleanser_admin ).
Unfortunately, we do not yet support a Custom Cleanser for this category.
For now I would recommend manually proposing a mitigation ( https://help.veracode.com/r/improve_mitigation ) and manually reaching out to your security team to request a review.
With regards to the line numbers, unfortunately, the binary does not contain accurate line numbers for async functions. While it may be possible to determine the appropriate line number with a significant amount of engineering effort, this is not currently supported.
For both of these suggestions I would recommend registering your ideas with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema
We have an Web API project and have [HttpPost] controller methods. They are being flagged with CSRF (CWE 352).
So, we implemented the fix, which is decorating our controller classes with [ApiController] attribute. But, still Veracode scan is flagging the same.
Interestingly, it resolved - CWE 915 (Improperly Controlled Modification of Dynamically-Determined Object) but not able to resolve CWE 352.
We are using .NET Core 3.1 version in our Web Api project. Any advice on how to fix this vulnerability.
Adding further, this API is not directly exposed to the customer facing area and there are couple of enterprise layers/ API gateways before the API endpoints could be reached.
.png){kind=logo}
For others that want to know more about the remediation for CWE 352 Cross-Site Request Forgery (CSRF) in .NET, Veracode Static Analysis reports this in a number of circumstances, in this case it saw several methods with the HttpPost attribute in a class extending from Microsoft.AspNetCore.Mvc.ControllerBase and did not see one of the following remediations:
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
...
services.AddMvc(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute())) //Will suppress all CSRF issues in Controllers.
.SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
...
}
Alternatively you can annotate your class as an [ApiController] as described in the Microsoft documentation: https://docs.microsoft.com/en-us/aspnet/core/web-api/?view=aspnetcore-3.1 .
Also please ensure before you review flaws that the application has been compiled per our Compilation Guide for .NET ( https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/UWyzuOKNbFbwQACRLkZVjA ) and ensure you are publishing your project with debug symbols (Debug profile).
Thank you,
Boy Baukema