VNX-936: Cross-Site Request Forgery protection disabled (Laravel, Symfony, Kotlin Spring Security)

Reports CSRF protection switched off in Laravel (wildcard $except, removed middleware, withoutMiddleware), Symfony (csrf_protection: false, form option) and Kotlin Spring Security (csrf { disable() }).

Field	Value
Rule ID	`VNX-936`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	PHP, Kotlin
CWE	CWE-936
CAPEC	CAPEC-62
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`csrf` `cwe-936`
Source	`internal/sast/rules/vnx-936.rego`

Overview

VNX-936 maps to CWE-936: OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery. With CSRF protection off, a page on another site can submit state-changing requests that the browser sends with the user’s session cookie. This rule covers the frameworks the other CSRF rules do not: VNX-352 (Django, Flask, Node.js, Rails), VNX-JAVA-010 (Spring in Java) and VNX-CS-005 (ASP.NET).

What Gets Flagged

class VerifyCsrfToken extends Middleware
{
    protected $except = [
        '*',                                                  // flagged
    ];
}

$middleware->web(remove: [ValidateCsrfToken::class]);         // flagged (Laravel 11)
Route::post('/account/transfer', ...)->withoutMiddleware([VerifyCsrfToken::class]);   // flagged
'csrf_protection' => false,                                   // flagged (Symfony form type)

framework:
    csrf_protection: false                                    # flagged

http {
    csrf { disable() }                                        // flagged
}
http.csrf().disable()                                         // flagged

Also flagged: a Laravel Kernel 'web' middleware group that omits the CSRF middleware (a commented-out entry counts as absent). Not flagged: $except entries naming specific paths ('stripe/webhook', 'api/*'), another middleware’s $except, configuration under when@test or config/packages/test, test files, a Kotlin configuration in the same file that is stateless and authenticates with bearer tokens, other disable() calls, comments and strings. The rule is evaluated only when the scanned tree contains PHP or Kotlin source, so a Symfony YAML file scanned alone, with no .php file beside it, is not read.

Remediation

Keep CSRF protection on and exempt only the specific endpoints that authenticate without cookies (webhooks, token-authenticated APIs):

protected $except = ['stripe/webhook'];

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-936
// nosec vnx-936

Or record an ignore rule: vulnetix ignore add --rule vnx-936 --reason "...". See Suppressing findings.