php-csrf-audit

PHP CSRF Audit (php-csrf-audit)

Analyze whether all interfaces in the PHP project source code that may cause state changes (POST/PUT/PATCH/DELETE, or GET with side effects) implement CSRF protection (token validation, SameSite/CORS coordination, double-submit cookie, etc.).

Grading and Numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability number:{C/H/M/L}-CSRF-{序号}

Protection Points and Mandatory Inspection Content (Mandatory)

Must identify and output:

1. State-changing entry points: the route's HTTP method, whether it contains side effects (writing to the database/updating permissions/initiating transactions/triggering tasks, etc.)
2. CSRF token generation: token source (session/cookie/random), field name, method of injection into forms or request headers
3. CSRF token validation: location and conditions of backend validation logic (whether it only validates logged-in users, whether bypass branches exist)
4. Validation bypass: whether there are cases such as "some branches do not validate", "only validates specific Content-Type", "only validates on AJAX", etc.
5. Same-origin/cross-site assistance:SameSite, CORS/cross-origin settings, Referer/Origin validation (note: relying on Referer/Origin alone may also be unstable)

Data Flow Tracing Requirements

Must trace at least one chain:

• From token source (e.g., $_SESSION['csrf']) to frontend output
• then to backend token reception ($_POST/headers) and validation (comparison/hash validation)

Report Output

Output to:

{output_path}/vuln_audit/csrf_{timestamp}.md

Vulnerability Entry Template (Mandatory)

Must include the following parts:

• Location evidence (route + validation function/middleware location)
• Data flow chain (token generation -> frontend carrying -> backend validation)
• Exploitation preconditions (whether login is required; whether the attacker can construct a page; browser same-site policy)
• Verification PoC (must include the real route and request structure; if login coordination is required, provide cookie/login-state description)
• Recommended remediation (placement of token validation, failure response strategy, unified field names, add coverage for bypass branches)

Evidence Citation (Mandatory: from php-route-tracer)

Each CSRF risk must cite the evidence points from the trace item by item (the status may be pending verification, but the evidence citation must exist):

1. EVID_CSRF_STATE_CHANGE_HANDLER_EXEC: Execution evidence of the state-changing handler (branch path evidence of the trace)
2. EVID_CSRF_TOKEN_SOURCE: Evidence of CSRF token source and generation (session/cookie/random, etc.)
3. EVID_CSRF_TOKEN_RECEIVE: Location evidence of where the CSRF token is received in the request/enters validation logic (parameter entry point/branch evidence of the trace)
4. EVID_CSRF_TOKEN_VERIFY: Location evidence of CSRF validation comparison/hash judgment (condition and early-exit evidence of the trace)
5. EVID_CSRF_BYPASS_BRANCH: Bypass branch evidence (e.g., only validating certain Content-Types or only validating for AJAX)

Handling of Missing Tracer Evidence (Mandatory)

• If the trace contract validation fails or any of the above key evidence points 1~5 is missing: the risk can only be marked as ⚠️待验证, and no assertion of "confirmed exploitable" may be given.