계: Environment

이 섹션에는 소스 코드 외부에 있지만 제작 중인 제품의 보안에는 여전히 중요한 내용이 모두 포함되어 있습니다. 이 섹션에서 다루는 문제들은 소스 코드와 직접적으로 관련이 없기 때문에 나머지 섹션과 분리했습니다.

External Content: Content Delivery Network

C#/VB.NET/ASP.NET

Abstract

필수적인 코드를 사용자에게 직접 제공하는 CDN에 의존하면 악성 코드가 실행될 수 있습니다.

Explanation

응용 프로그램의 의존적인 JavaScript를 제공하는 CDN의 사용은 응용 프로그램의 고유 서버에서 JavaScript를 제공하는 등 여러 많은 장점을 제공합니다. 이러한 장점에는 향상된 성능 및 응용 프로그램 소유자의 쉬운 코드 유지 관리가 포함됩니다. 그러나, 응용 프로그램은 CDN이 브라우저에 안전한 콘텐트를 제공한다고 가정합니다. 공격자가 CDN을 손상시키면 CDN은 사용자의 브라우저에 악성 코드를 전달합니다. 이제 사용자의 브라우저는 응용 프로그램이 제어하거나 악성으로 감지할 수 없는 코드를 실행하고 있습니다.

예제 1: 다음 ASPX 코드는 Microsoft CDN을 참조하여 Microsoft의 jQuery 코드를 포함합니다.


...
<script src="http://ajax.microsoft.com/ajax/jquery/jquery-1.4.2.min.js" type="text/javascript"></script>
...

예제 2: 다음 ASPX 코드는 Microsoft Ajax CDN에 대한 모든 ASP.NET 프레임워크 스크립트 요청의 자동 리디렉션을 활성화합니다.


...
<asp:ScriptManager
   ID="ScriptManager1"
   EnableCdn="true"
   Runat="Server" />
...

Example 2에서 ScriptManager 제어는 해당 ASPX 페이지를 구성하여 적절한 CDN에 대한 임의의 스크립트 요청을 자동으로 리디렉션합니다.

References

[1] Content Deliver Network and its Regulation The Journal of China Universities of Posts and Telecommunications

[2] Managed Content Security Delivery radware

[3] Standards Mapping - Common Weakness Enumeration CWE ID 94, CWE ID 98

[4] Standards Mapping - Common Weakness Enumeration Top 25 2019 [18] CWE ID 094

[5] Standards Mapping - Common Weakness Enumeration Top 25 2020 [17] CWE ID 094

[6] Standards Mapping - Common Weakness Enumeration Top 25 2022 [25] CWE ID 094

[7] Standards Mapping - Common Weakness Enumeration Top 25 2023 [23] CWE ID 094

[8] Standards Mapping - Common Weakness Enumeration Top 25 2024 [11] CWE ID 094

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001167

[10] Standards Mapping - FIPS200 SI

[11] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[12] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-18 Mobile Code (P2)

[13] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-18 Mobile Code

[14] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.2.5 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.8 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.3.6 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 5.3.9 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 10.3.2 Deployed Application Integrity Controls (L1 L2 L3), 12.3.3 File Execution Requirements (L1 L2 L3), 12.3.6 File Execution Requirements (L2 L3), 14.2.4 Dependency (L2 L3)

[15] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection

[16] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input

[17] Standards Mapping - OWASP Top 10 2007 A3 Malicious File Execution

[18] Standards Mapping - OWASP Top 10 2010 A1 Injection

[19] Standards Mapping - OWASP Top 10 2013 A1 Injection

[20] Standards Mapping - OWASP Top 10 2017 A1 Injection

[21] Standards Mapping - OWASP Top 10 2021 A03 Injection

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.3

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[31] Standards Mapping - SANS Top 25 2009 Risky Resource Management - CWE ID 094

[32] Standards Mapping - SANS Top 25 2010 Risky Resource Management - CWE ID 098

[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3600 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3600 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3600 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3600 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3600 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3600 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3600 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-003300 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-003300 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-003300 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-003300 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-003300 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-003300 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-003300 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-003300 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-003300 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-003300 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-003300 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-003300 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-003300 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-003300 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-003300 CAT II

[55] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.semantic.dotnet.external_content_content_delivery_network