Reino: Input Validation and Representation

Los problemas de validación y representación de entradas están causados por metacaracteres, codificaciones alternativas y representaciones numéricas. Los problemas de seguridad surgen de entradas en las que se confía. Estos problemas incluyen: «desbordamientos de búfer», ataques de «scripts de sitios», "SQL injection" y muchas otras acciones.

Denial of Service: Stack Exhaustion

Java/JSP

Abstract

Un atacante puede introducir datos especialmente diseñados para modificar o definir la implementación de la estructura de datos de un programa, lo que puede resultar en una denegación de servicio debido al agotamiento de la pila.

Explanation

Los datos especificados por el usuario que un programa usa directamente para modificar o definir la implementación de su estructura de datos pueden ser susceptibles de agotamiento de la pila. Por ejemplo, si un usuario puede crear enlaces circulares en una estructura de datos enlazada que se procesa de forma recursiva, esto puede conducir a una recurrencia infinita que da como resultado el agotamiento de la pila.

Ejemplo 1: El siguiente fragmento de código demuestra esta vulnerabilidad con Apache Log4j2.


Marker child = MarkerManager.getMarker("child");
Marker parent = MarkerManager.getMarker("parent");

child.addParents(MarkerManager.getMarker(userInput));
parent.addParents(MarkerManager.getMarker(userInput2)); 
        
String toInfinity = child.toString();

Este pequeño programa permite al usuario establecer el marcador principal de child y parent en un marcador definido por el usuario. Si el usuario introduce el marcador principal de child para que sea parent, y el marcador principal de parent para que sea child, se crea un enlace circular en la estructura de datos del marcador. Al ejecutar el método recursivo toString en la estructura de datos que contiene el enlace circular, el programa generará una excepción de desbordamiento de pila y fallará. Esto provoca una denegación de servicio por agotamiento de la pila.

References

[1] DOS-1: Beware of activities that may use disproportionate resources Oracle

[2] Standards Mapping - Common Weakness Enumeration CWE ID 730, CWE ID 674

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094, CCI-001310

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1), SI-10 Information Input Validation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection, SI-10 Information Input Validation

[6] Standards Mapping - OWASP API 2023 API4 Unrestricted Resource Consumption

[7] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[8] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation, Control Objective C.3.3 - Web Software Attack Mitigation

[18] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[40] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[41] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.dataflow.java.denial_of_service_stack_exhaustion