Reino: Security Features

La seguridad de un software no es un software de seguridad. Nos preocupamos de cuestiones como la autenticación, el control de acceso, la confidencialidad, la criptografía y la gestión de privilegios.

WCF Misconfiguration: Weak Class Reference

C#/VB.NET/ASP.NET

Abstract

El programa utiliza una referencia de clase débil, que podría permitir que un atacante ejecute código no autorizado.

Explanation

El programa hace referencia a una clase definida por el usuario que no está identificada de forma única. Cuando .NET carga esta clase débilmente identificada, el cargador de tipos CLR busca la clase en las siguientes ubicaciones en el orden especificado:

- Si se conoce el ensamblado del tipo, el cargador busca las ubicaciones de redireccionamiento del archivo de configuración, GAC, el ensamblado actual que utiliza la información de configuración y el directorio base de la aplicación.

- Si se desconoce el ensamblado, el cargador busca el ensamblado actual, mscorlib, y la ubicación devuelta por el controlador de eventos TypeResolve.

Este orden de búsqueda CLR se puede modificar con enlaces como el mecanismo de reenvío de tipos y el evento AppDomain.TypeResolve.

Si un atacante aprovecha el orden de búsqueda CLR creando una clase alternativa con el mismo nombre y colocándola en una ubicación alternativa que el CLR cargará primero, CLR ejecutará involuntariamente el código proporcionado por el atacante.

Ejemplo 1: El elemento <behaviorExtensions/> del archivo de configuración de WCF que aparece a continuación indica a WCF que agregue una clase de comportamiento personalizado a una extensión WCF en concreto.


<system.serviceModel>
    <extensions>
        <behaviorExtensions>
            <add name="myBehavior" type="MyBehavior" />
       </behaviorExtensions>
    </extensions>
</system.serviceModel>

References

[1] Microsoft Developer Network (MSDN)

[2] Standards Mapping - Common Weakness Enumeration CWE ID 95

[3] Standards Mapping - Common Weakness Enumeration Top 25 2019 [18] CWE ID 094

[4] Standards Mapping - Common Weakness Enumeration Top 25 2020 [17] CWE ID 094

[5] Standards Mapping - Common Weakness Enumeration Top 25 2022 [25] CWE ID 094

[6] Standards Mapping - Common Weakness Enumeration Top 25 2023 [23] CWE ID 094

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754

[8] Standards Mapping - FIPS200 SI

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[12] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[13] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.2.4 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.5 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.8 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.3.6 Output Encoding and Injection Prevention Requirements (L1 L2 L3)

[14] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[15] Standards Mapping - OWASP Top 10 2004 A6 Injection Flaws

[16] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws

[17] Standards Mapping - OWASP Top 10 2010 A1 Injection

[18] Standards Mapping - OWASP Top 10 2013 A1 Injection

[19] Standards Mapping - OWASP Top 10 2017 A1 Injection

[20] Standards Mapping - OWASP Top 10 2021 A03 Injection

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[32] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 116

[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3570 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3570 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3570 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3570 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3570 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3570 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3570 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002560 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002560 CAT I

desc.config.dotnet.wcf_misconfiguration_weak_class_reference