DShah866551 (Community Member) asked a question.
Help required to fix CWE-352 (CSRF) vulnerability in NodeJS/Express code
We have configured Veracode pipeline scan in GitHub Actions pipeline. The pipeline was working fine until last week but suddenly we are noticing failures highlighting CWE-352 (CSRF) issue in NodeJS/Express js code. We haven't modified javascript files in last 1 week and there is no information mentioned on why the Veracode pipeline scan is identifying the issue. Attached screenshot for reference.
Please help me with additional details to understand the reason of pipeline failure and potential fix.
Is there any update on Veracode side in last 1 week related to this vulnerability in pipeline scanner?
.png){kind=logo}
Hi @DShah866551 (Community Member),
I am not aware of a recent change with respect to CSRF in Node.js.
Veracode Static Analysis should stop reporting CSRF here if you use `csurf` (which you already do as I can see in the code screenshot) and apply it as a middleware to your `express` instance (e.g. as described here: http://expressjs.com/en/resources/middleware/csurf.html -> should be something like `app.use(csrfProtection)` in your use case).
If this does not solve the issue, please reach out to support@veracode.com while providing the link to the scan in the Veracode platform.
Thank you,
Florian Walter
Thanks Florian for quick response. I tried to add a line to explicitly use csrfProtection in app but still it is failing. Will reach out to support team with the scan details.
Regards,
Dipesh
Hi Florian,
I have managed to extract the scan result detailed description.
Details: <span>This Express application does not appear to use a known library or tool to protect against cross-site request forgery. </span> <span>Ensure that all actions and routes that modify data are either protected with anti-CSRF tokens, or are designed in such a way to eliminate CSRF risk.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/352.html">CWE</a> <a href="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md">OWASP</a></span>
1904
https://downloads.veracode.com/securityscan/cwe/v4/java/352.html
But we are using csurf library. Can this be a false positive? If yes, how can we resolve it? Please suggest.
Hi @DShah866551 (Community Member), please reach out to support@veracode.com while providing the link to the scan in the Veracode platform.