TSaha029552 (Community Member) asked a question.
CSRF (CWE - 352) flaw in Web Api Controllers
We have an Web API project and have [HttpPost] controller methods. They are being flagged with CSRF (CWE 352).
So, we implemented the fix, which is decorating our controller classes with [ApiController] attribute. But, still Veracode scan is flagging the same.
Interestingly, it resolved - CWE 915 (Improperly Controlled Modification of Dynamically-Determined Object) but not able to resolve CWE 352.
We are using .NET Core 3.1 version in our Web Api project. Any advice on how to fix this vulnerability.
Adding further, this API is not directly exposed to the customer facing area and there are couple of enterprise layers/ API gateways before the API endpoints could be reached.
.png){kind=logo}
Hi @TSaha029552 (Community Member)
These are False positives and should be fixed in an upcoming release of Veracode Static Analysis engine.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
Hi @Kashif, Security Consultant (Veracode inc)
is the above False positive fixed? Still I am able to see this issue on the veracode greenlight scan in my VS2022 IDE.
Thanks for your prompt response.
Just wanted to know when the upcoming release is slated?