  Cross-Site Request Forgery (CSRF) vulnerabilities are a severe class of web
vulnerabilities that have received only marginal attention from the research
and security testing communities. While much effort has been spent on
countermeasures and detection of XSS and SQLi, to date, the detection of CSRF
vulnerabilities is still performed predominantly manually.
  In this paper, we present Deemon, to the best of our knowledge the first
automated security testing framework to discover CSRF vulnerabilities. Our
approach is based on a new modeling paradigm which captures multiple aspects of
web applications, including execution traces, data flows, and architecture
tiers in a unified, comprehensive property graph. We present the paradigm and
show how a concrete model can be built automatically using dynamic traces.
Then, using graph traversals, we mine for potentially vulnerable operations.
Using the information captured in the model, our approach then automatically
creates and conducts security tests, to practically validate the found CSRF
issues. We evaluate the effectiveness of Deemon with 10 popular open source web
applications. Our experiments uncovered 14 previously unknown CSRF
vulnerabilities that can be exploited, for instance, to take over user accounts
or entire websites.
