AppSec SaaS Platform | Integrated, cloud-based AST solution optimized for development and DevSecOps teams.

AppSec IDE Plug-ins | Secure code as you write it in your IDE

Software Risk Management | Manage application security programs at enterprise scale

DevSecOps Integrations | Integrate AppSec tools into DevOps workflows

Static Analysis (SAST) | Address security and quality defects in code as it's being developed

Software Composition Analysis (SCA) | Secure and manage open source risks in applications and containers

Interactive Analysis (IAST) | Automate web security testing within your DevOps pipelines

Dynamic Analysis (DAST) | Continuous web application security testing in production.

Penetration Testing | Identify business-critical vulnerabilities with on-demand testing expertise.

Protocol Fuzzing | Identify defects and zero-day vulnerabilities in services and protocols

Program Strategy & Planning | Measure, scale, and optimize your AppSec program

Threat & Risk Assessments | Understand and address internal and external security risks

Security Training | Equip development teams with the skills they need to produce more secure software

Implementation & Deployment | Optimize utilization, management and deployment of AppSec tools

Security Testing Services | On-demand AppSec testing resources and expertise

Open Source & Security Audits | Comprehensive technical due diligence services for M&A

Dev and DevOps Teams | Build secure software while maintaining developer productivity and pipeline velocity.

Security Teams | Align people, processes, and technology to minimize software risk and transform your business.

Legal Teams | Solutions to protect your IP and manage risk.

API Security Testing | Manage software risks with a holistic API security testing program.

Application Security Testing | Solutions to address security risks at all stages of the application life cycle.

DevSecOps | Solutions to help shift security left without slowing down your development teams.

Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.

Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud

Open Source Security & License Management | Effective solutions for ensuring open source security and license compliance

Malicious Code Detection | What hidden threats are lurking under the surface of your code?

M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.

Quality & Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators

Financial Services | Protect sensitive customer and financial data from rapidly evolving security threats.

IoT & Embedded | Ensure your embedded and IoT devices are safe, secure, and reliable.

Automotive | Build software security & reliability into the modern connected car.

Telecommunications | Create seamless and safe mobile experiences, from silicon to software.

Aerospace & Defense | Solutions for automating mission-critical development.

Public Sector | Application security for government agencies and their suppliers.

Medical Device | Safeguard medical devices and applications.

Our Commitment | Gain the confidence to implement, deploy, and grow with your AppSec tools

Meet Your Team | Achieve your AppSec goals with support from Synopsys experts.

Customer Testimonials | Application security customer success stories

Submit a Ticket | Visit our customer community for online support.

Documentation | Comprehensive user guides and how-to articles. <.>

Customer Community | Search for answers, knowledge articles, tutorials, documentation, and more.

Product Education | Interactive courseware designed to help implement best practices for secure code.

Premium & Designated Support | Support with expedited response times and access to specialized technical, tactical, and operational knowledge.

Implementation & Deployment | Discover how to best utilize, manage, and deploy your application testing tools.

AppSec Training | Equip development teams with the skills they need to produce more secure software.

Open Source and Software Supply Chain News

Fuzz Testing News

Security and Developer Training News

Software Composition News

Secure Software Development News

Security Risk News

Security Research News

AppSec Program Strategy News | Get insights from Synopsys cybersecurity experts on building a security program.

DAST News | Expert insight on dynamic analysis (DAST).

IAST News | Expert insight on interactive analysis (IAST).

SAST News | Expert insight on static analysis (SAST).

Open Source and Software Supply Chain News | Discover open source and software supply chain risk management tips and best practices.

Fuzz Testing News | Learn more about fuzz testing, including instrumentation techniques and best practices.

Security and Developer Training News | Articles on security and developer training to help strengthen your team’s knowledge around security

Software Composition News | Expert insight on software composition analysis (SCA).

Secure Software Development News | Read articles about implementing security measures throughout the software development life cycle.

Security Risk News | Read the latest information on how to manage application security risks.

Security Research News | Get an analysis of today’s application security news and research.

Case Studies | Application security customer stories

eBooks | Browse the latest ebooks on software security trends and best practices

Glossary | Glossary of Application Security, EDA & Semiconductor IP terms

Reports | Browse the latest application security reports from Synopsys and industry-leading analysts.

Webinars | Browse the latest webinars on application security solutions, trends, and strategies.

White Papers | Access the latest white papers for technical knowledge on application security solutions.

Overview | Learn more about the Synopsys Cybersecurity Research Center.

Research | Access the latest first-party research and analysis from the Synopsys Cybersecurity Research Center.

Press Releases | Browse our most recent news releases.

Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. CSRF attacks exploit the trust a Web application has in an authenticated user. (Conversely, cross-site scripting (XSS) attacks exploit the trust a user has in a particular Web application). A CSRF attack exploits a vulnerability in a Web application if it cannot differentiate between a request generated by an individual user and a request generated by a user without their consent.

An attacker’s aim for carrying out a CSRF attack is to force the user to submit a state-changing request. Examples include:

Submitting or deleting a record.

Submitting a transaction.

Purchasing a product.

Changing a password.

Sending a message.

Social engineering platforms are often used by attackers to launch a CSRF attack. This tricks the victim into clicking a URL that contains a maliciously crafted, unauthorized request for a particular Web application. The user’s browser then sends this maliciously crafted request to a targeted Web application. The request also includes any credentials related to the particular website (e.g., user session cookies). If the user is in an active session with a targeted Web application, the application treats this new request as an authorized request submitted by the user. Thus, the attacker succeeds in exploiting the Web application’s CSRF vulnerability.

A CSRF attack targets Web applications failing to differentiate between valid requests and forged requests controlled by attacker. There are many ways for an attacker to try and exploit the CSRF vulnerability.

To give you an example, let’s say that Bob has an online banking account on samplebank.com. He regularly visits this site to conduct transactions with his friend Alice. Bob is unaware that samplebank.com is vulnerable to CSRF attacks. Meanwhile, an attacker aims to transfer $5,000 from Bob’s account by exploiting this vulnerability. To successfully launch this attack:

The attacker must build an exploit URL.

The attacker must also trick Bob into clicking the exploit URL.

Bob needs to have an active session with samplebank.com.

Let’s say that the online banking application is built using the GET method to submit a transfer request. As such, Bob’s request to transfer $500 to Alice (with account number 213367) might look like this:

GET https://samplebank.com/onlinebanking/transfer?amount=500&accountNumber=213367 HTTP/1.1

Aligning with the first requirement to successfully launch a CSRF attack, an attacker must craft a malicious URL to transfer $5,000 to the account 425654:

https://samplebank.com/onlinebanking/transfer?amount=5000&accountNumber=425654

Using various social engineering attack methods, an attacker can trick Bob into loading the malicious URL. This can be achieved in various ways. For instance, including malicious HTML image elements onto forms, placing a malicious URL on pages that are often accessed by users while logged into the application, or by sending a malicious URL through email.

The following is an example of a disguised URL:

<img src  = “https://samplebank.com/onlinebanking/transfer?amount=5000&accountNumber=425654” width=“0” height= “0”>

Consider the scenario that includes an image tag in an attacker-crafted email to Bob. Upon receiving it, Bob’s browser application opens this URL automatically—without human intervention. As a result, without Bob’s permission, a malicious request is sent to the online banking application. If Bob has an active session with samplebank.com, the application would treat this as an authorized amount transfer request coming from Bob. It would then transfer the amount to the account specified by an attacker.

There are some limitations. To carry out a successful CSRF attack, consider the following:

The success of a CSRF attack depends on a user’s session with a vulnerable application. The attack will only be successful if the user is in an active session with the vulnerable application.

An attacker must find a valid URL to maliciously craft. The URL needs to have a state-changing effect on the target application.

An attacker also needs to find the right values for the URL parameters. Otherwise, the target application might reject the malicious request.

To defeat a CSRF attack, applications need a way to determine if the HTTP request is legitimately generated via the application’s user interface. The best way to achieve this is through a CSRF token. A CSRF token is a secure random token (e.g., synchronizer token or challenge token) that is used to prevent CSRF attacks. The token needs to be unique per user session and should be of large random value to make it difficult to guess.

A CSRF secure application assigns a unique CSRF token for every user session. These tokens are inserted within hidden parameters of HTML forms related to critical server-side operations. They are then sent to client browsers.

It is the application team’s responsibility to identify which server-side operations are sensitive in nature. The CSRF tokens must be a part of the HTML form—not stored in session cookies. The easiest way to add a non-predictable parameter is to use a secure hash function (e.g., SHA-2) to hash the user’s session ID. To ensure randomness, the tokens must be generated by a cryptographically secure random number generator.

Whenever a user invokes these critical operations, a request generated by the browser must include the associated CSRF token. This will be used by the application server to verify the legitimacy of the end-user request. The application server rejects the request if the CSRF token fails to match the test.