CSRFinder: Enhanced CSRF Vulnerability Detection via Dangerous Request Features and GBDT algorithm

Cross-Site Request Forgery (CSRF) vulnerabilities exploit legitimate user actions through unauthorized mechanisms, leading to data tampering, sensitive information leakage, and even system outages, thereby posing a serious threat to the widespread deployment of the industrial Internet. Traditional vulnerability detection methods struggle to effectively address the inherent complexities of CSRF vulnerabilities, resulting in low detection efffciency and limited practical effectiveness. To improve detection efffciency and accuracy, we propose CSRFinder, an enhanced CSRF vulnerability detection method based on dangerous requests and Gradient Boosting Regression Tree (GBDT) algorithm. It ffrst addresses the challenge of collecting dangerous request data by deffning explicit rules for identifying dangerous requests and constructing feature datasets that incorporate both attribute-based and textual features. Building on these datasets, CSRFinder employs an ensemble learning approach with multiple classiffers to train a request classiffcation model. Finally, for candidate dangerous requests identiffed, request replay techniques are employed to construct request forgery scenarios and corresponding vulnerability determination strategies. CSRF vulnerabilities are identiffed by comparing the responses and corresponding database operations triggered by the original and forged requests. CSRFinder was validated on 15 real-world open-source web applications. Compared with single classiffers and standalone deep learning methods, the GBDT classiffer demonstrated superior performance. Speciffcally, CSRFinder identiffed 3 CSRF vulnerabilities in PrestaShop websites that were missed by the SOTA method Deemon, while producing only one false positive. Additionally, it detected 9 more CSRF vulnerabilities than the classic method Mitch and exhibited superior overall performance across multiple evaluation metrics.