skills.rest
bs-koo
bs-kooCOMMUNITY
Explore all skills by this author →
GitHub

detecting-csrf-vulnerabilities

Detects CSRF vulnerabilities in Spring Boot and JSP/Servlet applications using Semgrep rules and AI context verification.

Updated Jun 24, 2026
Search Tags:#web-security#static-analysis#semgrep#csrf#spring-security#jsp#cwe-352
One-click install
npx skills add https://github.com/bs-koo/gx-security --skill detecting-csrf-vulnerabilities-bs-koo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-csrf-vulnerabilities
Source: https://github.com/bs-koo/gx-security/tree/main/skills/detecting-csrf-vulnerabilities
Command: npx skills add https://github.com/bs-koo/gx-security --skill detecting-csrf-vulnerabilities-bs-koo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Web applications that rely on cookie-based sessions can be exploited through Cross-Site Request Forgery when state-changing endpoints lack token protection. Manually auditing every form, controller, and security config across mixed Spring Boot and legacy JSP codebases is slow and error-prone. ## Core Features & Use Cases - Automatic stack detection: Distinguishes spring-modern (Spring Boot + SPA) from jsp-legacy (JSP/Servlet + WAR) projects, even when mixed in one repository, and applies the matching Semgrep rules. - Hybrid scanning with AI verification: Runs scripts/scan_csrf.py (Semgrep with grep fallback) to gather candidates, then verifies each finding in context—distinguishing real vulnerabilities from intentional exceptions like stateless JWT APIs. - Standardized 4-element reports: Every confirmed finding documents what is vulnerable, why, how it is exploited (with PoC), and how to fix it, ordered by severity. - Use Case: Before releasing a Spring Boot member-management service, run the scan to confirm whether csrf().disable() in SecurityConfig exposes cookie-session endpoints, and receive a fix using CookieCsrfTokenRepository. ## Quick Start Ask the AI to check the project at a given source path for CSRF vulnerabilities, for example by requesting a CSRF audit of your Spring Boot or JSP application directory.

Frequently Asked Questions about detecting-csrf-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a Spring Boot application for CSRF vulnerabilities?▼

Run the scan_csrf.py script against the project source, which applies Semgrep rules to find csrf().disable() calls and permissive CORS settings. Each candidate is then verified in context to determine whether cookie-based sessions make it exploitable or whether stateless JWT makes it an intentional exception.

How to detect CSRF issues in legacy JSP Servlet applications?▼

The scanner flags POST forms without CSRF token hidden fields, Servlet doPost methods lacking token verification, and state-changing GET links like delete or withdraw URLs. It also checks web.xml for a global CSRFGuard filter, since its absence means every form needs individual review.

Is csrf().disable() always a vulnerability in Spring Security?▼

No. If the API is purely stateless with JWT in the Authorization header and no cookie authentication, disabling CSRF is an intentional exception. It is a genuine vulnerability when authentication relies on cookies such as JSESSIONID, because browsers attach cookies to cross-site requests automatically.

Does the CSRF scanner work without Semgrep installed?▼

Yes, the script falls back to regex-based grep scanning when Semgrep is unavailable. The fallback has lower recall, so a zero-findings result does not guarantee safety, and the tool prints a warning recommending Semgrep installation for higher precision.

What are the limitations of static CSRF detection?▼

Static rules cannot prove token absence in forms because that is a negative pattern, so AI verification must review each form and filter configuration. Auxiliary defenses like SameSite cookie attributes and CORS policies also require manual context checks beyond what the scanner captures.

Related Skills

Explore More Software Engineering Skills→
allanninalallanninal
1

semgrep

Scan codebases for security vulnerabilities and coding standards with Semgrep.

Community
Intermediate
duriandurinoduriandurino

exploit

Execute exploits against confirmed vulnerabilities using Metasploit and public scripts.

Community
Advanced
nishilbhavenishilbhave
4

codeprobe-security

Scan codebases to identify and score security vulnerabilities with remediation guidance.

Community
Advanced
715494637715494637
335

find-crypto-entry

Locate cryptographic parameter generators in JavaScript applications via static and dynamic analysis.

Community
Advanced