Summary

Requests that execute transactions must not follow any distinguishable pattern.

Description

When they are implemented, distinguishable transaction patterns make it easier for malicious actors or unauthorized users to anticipate and exploit the system. By introducing randomness or unpredictability, the likelihood of unauthorized access or manipulation of system's flows is reduced.

Supported In

This requirement is verified in following services

References

• CAPEC™-21. Exploitation of trusted identifiers
• CAPEC™-31. Accessing/Intercepting/Modifying HTTP cookies
• CWE™-352. Cross-site request forgery (CSRF)
• PA-DSS-5_2_9. Cross-site request forgery (CSRF)
• SANS 25-9. Cross-site request forgery (CSRF)
• CMMC-AC_L1-3_1_2. Transaction & function control
• HITRUST CSF-09_y. On-line transactions
• WASSEC-6_1_2. URL patterns
• WASSEC-6_2_3_5. Client-side attacks - Cross-site request forgery
• WASC-A_09. Cross-site request forgery
• MVSP-3_3. Application implementation controls - Vulnerability prevention
• CWE TOP 25-352. Cross-site request forgery (CSRF)
• SWIFT CSCF-2_1. Internal data flow security
• PCI DSS-6_2_4. Software engineering techniques to prevent or mitigate common software attacks
• OWASP ASVS-13_2_3. RESTful web service

Vulnerabilities

• 007.Cross-site request forgery

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.