Kingdom: Input Validation and Representation

Input validation and representation problems ares caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others.

Denial of Service: Format String

Java/JSP

Abstract

Allowing user input to control format parameters could enable an attacker to cause exceptions to be thrown or leak information.

Explanation

Attackers may be able to modify the format string argument such that an exception is thrown. If this exception is left uncaught, it may crash the application. Alternatively, if sensitive information is used within the other arguments, attackers may change the format string to reveal this information.

Example 1: The following code allows a user to specify the format string argument to Formatter.format().


  ...
  Formatter formatter = new Formatter(Locale.US);
  String format = "The customer: %s %s has the balance %4$." + userInput + "f";
  formatter.format(format, firstName, lastName, accountNo, balance);
  ...

The intention of this program is to let the user specify the decimal points to which it shows the balance. In reality though, there are no restrictions on this. If the user can specify anything, it may cause an exception such as java.util.MissingFormatArgumentException to be thrown, and since this is not within a try block, could lead to application failure.
Even more critical within this example, if an attacker can specify the user input "2f %3$s %4$.2", the format string would be "The customer: %s %s has the balance %4$.2f %3$s %4$.2". This would then lead to the sensitive accountNo to be included within the resulting string.

References

[1] IDS06-J. Exclude unsanitized user input from format strings CERT

[2] Standards Mapping - Common Weakness Enumeration CWE ID 730

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094, CCI-001310

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1), SI-10 Information Input Validation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection, SI-10 Information Input Validation

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[8] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[9] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[10] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[11] Standards Mapping - OWASP Top 10 2013 A1 Injection

[12] Standards Mapping - OWASP Top 10 2017 A1 Injection

[13] Standards Mapping - OWASP Top 10 2021 A03 Injection

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[24] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[46] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[47] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.dataflow.java.denial_of_service_format_string