Document information

Document ID:4198
Subject:Cross Site Request Forgery in SynaMan
Creation date:4/27/15 12:52 PM
Last modified on:7/28/15 9:45 AM


Cross-site request forgery (CSRF)

Similar to any web based application, SynaMan is also vulnerable to attacks from the Internet. In many cases, such as an XSS attack, SynaMan automatically handles and prevents such intrusion. In case of CSRF attacks, however, administrators have an option to disable it completely on their SynaMan server.

It is important to understand what CSRF is and how can someone attack before disabling this feature, which is turned on by default. Rather than going into technical details this page talks about how such attacks related to SynaMan. Click here for more technical information about this type of an attack.

Conditions

Several things have to happen simultaneously for cross-site request forgery to succeed in SynaMan:

  • This attack only affects administrators, not regular users.
  • It can only be carried out if an administrator follows a link (usually sent via email) from an untrusted person, AND
  • The administrator must be logged in to SynaMan Server web interface when the untrusted link was clicked, AND
  • The attacker must know the IP address and port where SynaMan Server is running, which could be running on a LAN
In short, you will not become a victim of this attack as long as you do not click on a link sent via email while logged in to SynaMan web interface. Therefore, from a practical perspective it is very unlikely you will become a victim of such an attack.

Users on sites like Facebook.com and Twitter.com are more likely to become victims of such attach because:
  1. The URL (host and port) are publicly known on the Internet
  2. These sites have a longer session timeout
  3. Many users are novice when it comes to computer security and are more likely to click on links sent by unknown users.


Benefits of turning this feature off

There are a couple of benefits:

  • Increased performance
  • When users stay on the same screen for long time they could see an error that say Page is Forbidden. Click here for a screenshot.

When should I turn this feature on?

Consider turning this feature on if your company policy requires it or you are required by law to handle this problem.

How to enable/disable

  • Login as admin
  • Click Configuration
  • Select Security tab
  • Uncheck or check Disable CSRF prevention







Add a comment to this document

Do you have a helpful tip related to this document that you'd like to share with other users? Please add it below. Your name and tip will appear at the end of the document text.
Your name:
Your email:
Hide my email address
Verification code:
Enter the verification code you see above more submitting your tip
Tip:Please limit tips to 1000 characters

Navigation

Social Media

Powered by 10MinutesWeb.com