CGI Generic Cross-Site Request Forgery Detection

#!/usr/bin/env python3
# Heuristic verifier for Tenable plugin 56818-style CSRF findings.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import argparse
import re
import sys
from html.parser import HTMLParser
from urllib.parse import urljoin

try:
    import requests
except Exception:
    print('UNKNOWN - requests module not installed')
    sys.exit(2)

TOKEN_PATTERNS = [
    re.compile(p, re.I) for p in [
        r'csrf', r'xsrf', r'authenticity', r'nonce', r'_token', r'requestverificationtoken'
    ]
]
UNSAFE_METHODS = {'post', 'put', 'patch', 'delete'}

class FormParser(HTMLParser):
    def __init__(self):
        super().__init__()
        self.forms = []
        self._current = None

    def handle_starttag(self, tag, attrs):
        attrs = dict(attrs)
        if tag.lower() == 'form':
            self._current = {
                'method': attrs.get('method', 'get').lower(),
                'action': attrs.get('action', ''),
                'inputs': []
            }
        elif tag.lower() == 'input' and self._current is not None:
            self._current['inputs'].append({
                'type': attrs.get('type', 'text').lower(),
                'name': attrs.get('name', ''),
                'id': attrs.get('id', ''),
                'value': attrs.get('value', '')
            })

    def handle_endtag(self, tag):
        if tag.lower() == 'form' and self._current is not None:
            self.forms.append(self._current)
            self._current = None


def looks_like_token(name_or_id, value):
    s = f"{name_or_id} {value}".strip()
    return any(p.search(s) for p in TOKEN_PATTERNS)


def get_cookie_samesite_flags(resp):
    raw = []
    try:
        raw = resp.raw.headers.get_all('Set-Cookie') or []
    except Exception:
        header = resp.headers.get('Set-Cookie')
        if header:
            raw = [header]
    flags = []
    for c in raw:
        m = re.search(r'(?i)\bSameSite\s*=\s*([^;]+)', c)
        flags.append(m.group(1).strip() if m else 'ABSENT')
    return flags


def main():
    ap = argparse.ArgumentParser(description='Heuristic CSRF checker for a single page')
    ap.add_argument('url', help='Target URL to inspect')
    ap.add_argument('--cookie', default='', help='Optional Cookie header, e.g. "SESSIONID=abc123; other=value"')
    ap.add_argument('--timeout', type=int, default=15, help='HTTP timeout in seconds')
    args = ap.parse_args()

    sess = requests.Session()
    headers = {'User-Agent': 'noisgate-csrf-check/1.0'}
    if args.cookie:
        headers['Cookie'] = args.cookie

    try:
        resp = sess.get(args.url, headers=headers, timeout=args.timeout, allow_redirects=True, verify=True)
    except Exception as e:
        print(f'UNKNOWN - request failed: {e}')
        sys.exit(2)

    ctype = resp.headers.get('Content-Type', '')
    if 'html' not in ctype.lower() and '<form' not in resp.text.lower():
        print('UNKNOWN - target did not return HTML form content')
        sys.exit(2)

    parser = FormParser()
    parser.feed(resp.text)
    forms = parser.forms
    if not forms:
        print('UNKNOWN - no forms found on supplied page')
        sys.exit(2)

    samesite = get_cookie_samesite_flags(resp)
    all_have_protection = True
    found_suspicious = []

    for form in forms:
        method = form['method'] or 'get'
        action = urljoin(resp.url, form['action'] or resp.url)
        token_found = False
        for inp in form['inputs']:
            if inp['type'] == 'hidden' and (looks_like_token(inp['name'], inp['value']) or looks_like_token(inp['id'], inp['value'])):
                token_found = True
                break

        if method in UNSAFE_METHODS:
            if not token_found:
                all_have_protection = False
                found_suspicious.append(f'{method.upper()} {action} (no obvious token)')
        elif method == 'get':
            # GET forms are only suspicious if they appear action-oriented.
            joined = ' '.join([inp.get('name', '') for inp in form['inputs']]).lower() + ' ' + action.lower()
            if any(x in joined for x in ['delete', 'remove', 'update', 'save', 'create', 'admin', 'password', 'role', 'user']):
                all_have_protection = False
                found_suspicious.append(f'GET {action} (appears state-changing)')

    # Decision logic:
    # VULNERABLE: unsafe/state-changing-looking form with no obvious token AND cookie SameSite absent/None or no cookies seen.
    # PATCHED: all unsafe forms have obvious token indicators OR no unsafe/state-changing-looking forms are present and cookies are restrictive.
    # UNKNOWN: mixed/inconclusive.
    restrictive_cookie = any(str(x).lower() in ('lax', 'strict') for x in samesite)
    permissive_cookie = any(str(x).lower() in ('none', 'absent') for x in samesite) or len(samesite) == 0

    if found_suspicious and permissive_cookie:
        print('VULNERABLE - suspicious forms found and session cookie policy appears permissive: ' + '; '.join(found_suspicious))
        sys.exit(1)

    if all_have_protection:
        print('PATCHED - all unsafe forms found on this page have obvious anti-CSRF token indicators')
        sys.exit(0)

    if found_suspicious and restrictive_cookie:
        print('UNKNOWN - suspicious forms found, but cookie SameSite appears restrictive; manual proxy test still required: ' + '; '.join(found_suspicious))
        sys.exit(2)

    print('UNKNOWN - inconclusive heuristic result; perform authenticated proxy-based validation')
    sys.exit(2)

if __name__ == '__main__':
    try:
        main()
    except KeyboardInterrupt:
        print('UNKNOWN - interrupted')
        sys.exit(2)