Reino: Input Validation and Representation

Los problemas de validación y representación de entradas están causados por metacaracteres, codificaciones alternativas y representaciones numéricas. Los problemas de seguridad surgen de entradas en las que se confía. Estos problemas incluyen: «desbordamientos de búfer», ataques de «scripts de sitios», "SQL injection" y muchas otras acciones.

Denial of Service: Format String

Java/JSP

Abstract

Permitir que la entrada del usuario controle los parámetros del formato puede habilitar a un usuario malintencionado para producir excepciones o filtrar información.

Explanation

Un usuario malintencionado puede modificar el argumento de cadena de formato de manera que se produzca una excepción. Si no se captura la excepción, esta podría bloquear la aplicación. Alternativamente, si se usa información confidencial en los otros argumentos, un usuario malintencionado podría cambiar la cadena de formato para revelar dicha información.

Ejemplo 1: el siguiente código permite al usuario especificar el argumento de cadena de formato como Formatter.format().


  ...
  Formatter formatter = new Formatter(Locale.US);
  String format = "The customer: %s %s has the balance %4$." + userInput + "f";
  formatter.format(format, firstName, lastName, accountNo, balance);
  ...

El objetivo de este programa es permitir que el usuario especifique los puntos decimales en los que se muestre el balance. Sin embargo, en realidad no existen restricciones sobre esto. Si el usuario puede especificar cualquier cosa, podría producir una excepción java.util.MissingFormatArgumentException y, puesto que no está en un bloque try, provocar un error en la aplicación.
Una situación todavía más crítica dentro del mismo ejemplo: si un usuario malintencionado especifica la entrada de usuario "2f %3$s %4$.2", la cadena de formato sería "El cliente: %s %s presenta un balance de %4$.2f %3$s %4$.2". Esto supondría la inclusión del accountNo confidencial en la cadena resultante.

References

[1] IDS06-J. Exclude unsanitized user input from format strings CERT

[2] Standards Mapping - Common Weakness Enumeration CWE ID 730

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094, CCI-001310

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1), SI-10 Information Input Validation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection, SI-10 Information Input Validation

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[8] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[9] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[10] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[11] Standards Mapping - OWASP Top 10 2013 A1 Injection

[12] Standards Mapping - OWASP Top 10 2017 A1 Injection

[13] Standards Mapping - OWASP Top 10 2021 A03 Injection

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[24] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[46] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[47] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.dataflow.java.denial_of_service_format_string