Kingdom: API Abuse
An API is a contract between a caller and a callee. The most common forms of API abuse are caused by the caller failing to honor its end of this contract. For example, if a program fails to call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller abuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated.
ASP.NET MVC Bad Practices: Model With Required Non-Nullable Property
Abstract
The model class has a required non-nullable property and therefore may be susceptible to under-posting attacks.
Explanation
Using a model class that has non-nullable properties that are required (as marked with the
The ASP.NET MVC framework will try to bind request parameters to model properties.
If a model has a required non-nullable parameter and an attacker does not communicate that required parameter in a request -- that is, the attacker uses an under-posting attack -- then the property will have the default value (usually zero) which will satisfy the
The following code defines a possible model class that has a required enum, which is non-nullable:
[Required] attribute) can lead to problems if an attacker communicates a request that contains less data than is expected.The ASP.NET MVC framework will try to bind request parameters to model properties.
If a model has a required non-nullable parameter and an attacker does not communicate that required parameter in a request -- that is, the attacker uses an under-posting attack -- then the property will have the default value (usually zero) which will satisfy the
[Required] validation attribute. This may produce unexpected application behavior.The following code defines a possible model class that has a required enum, which is non-nullable:
public enum ArgumentOptions
{
OptionA = 1,
OptionB = 2
}
public class Model
{
[Required]
public String Argument { get; set; }
[Required]
public ArgumentOptions Rounding { get; set; }
}
References
[1] Input Validation vs. Model Validation in ASP.NET MVC
[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.0
[3] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete
[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0
[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 3
[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity
[7] Standards Mapping - CIS Kubernetes Benchmark partial
[8] Standards Mapping - Common Weakness Enumeration CWE ID 345
[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002422
[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-8 Transmission Confidentiality and Integrity (P1)
[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-8 Transmission Confidentiality and Integrity
[12] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input
[13] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws
[14] Standards Mapping - OWASP Top 10 2010 A1 Injection
[15] Standards Mapping - OWASP Top 10 2013 A1 Injection
[16] Standards Mapping - OWASP Top 10 2017 A1 Injection
[17] Standards Mapping - OWASP Top 10 2021 A03 Injection
[18] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization
[19] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.5.3 Token-based Session Management (L2 L3), 13.2.6 RESTful Web Service Verification Requirements (L2 L3)
[20] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls
[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6
[22] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002470 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002470 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002470 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002470 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002470 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002470 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002470 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002470 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002470 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002470 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002470 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002470 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002470 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002470 CAT II
[36] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)
desc.structural.dotnet.aspnet_mvc_bad_practices_required_non_nullable_in_model