계: Input Validation and Representation

입력 검증 및 표현 문제는 메타 문자, 대체 인코딩 및 숫자 표현 때문에 발생합니다. 보안 문제는 입력을 신뢰하기 때문에 발생합니다. 문제로는 "Buffer Overflows", "Cross-Site Scripting" 공격, "SQL Injection", 그 외 여러 가지가 있습니다.

Dynamic Code Evaluation: Code Manipulation

Java/JSP

Abstract

확인되지 않은 사용자 입력이 동적으로 실행되는 코드의 런타임 환경에 영향을 미치도록 허용하면 공격자가 악성 코드를 실행할 수 있습니다.

Explanation

현대의 많은 프로그래밍 언어가 소스 명령어의 동적 해석을 허용합니다. 이 기능을 사용하여 프로그래머가 사용자에게서 받은 입력에 따라 동적 작업을 수행할 수 있습니다. 코드 조작 취약점은 사용자가 제공하는 데이터가 동적으로 실행되는 코드의 런타임 환경 측면을 변경하도록 프로그래머가 허용할 때 발생합니다. 적절한 검증 없이 프로그래머가 의도하지 않은 작업을 사용자가 지정할 수 있습니다.

예제: 이 예제에서는 응용 프로그램이 웹 응용 프로그램에서 스크립트 실행 범위를 검색합니다.


...
   ScriptEngineManager scriptEngineManager = new ScriptEngineManager();
   ScriptEngine scriptEngine = scriptEngineManager.getEngineByExtension("js");
   ScriptContext newContext = new SimpleScriptContext();
   Bindings engineScope = newContext.getBindings(request.getParameter("userName"));

   userOps = request.getParameter("operation");
   Object result = scriptEngine.eval(userOps,newContext);
...

프로그램은 page_scope 매개 변수가 예상된 사용자 이름인 경우에 바르게 작동합니다. 그러나 공격자가 GLOBAL_SCOPE의 값을 지정할 경우, 이 작업은 동일한 ScriptEngine에 의해 생성된 모든 엔진 내의 모든 속성에 접근할 수 있게 됩니다.

References

[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 4

[2] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 4

[5] Standards Mapping - CIS Google Cloud Computing Platform Benchmark complete

[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[7] Standards Mapping - CIS Kubernetes Benchmark complete

[8] Standards Mapping - Common Weakness Enumeration CWE ID 94, CWE ID 494

[9] Standards Mapping - Common Weakness Enumeration Top 25 2019 [18] CWE ID 094

[10] Standards Mapping - Common Weakness Enumeration Top 25 2020 [17] CWE ID 094

[11] Standards Mapping - Common Weakness Enumeration Top 25 2022 [25] CWE ID 094

[12] Standards Mapping - Common Weakness Enumeration Top 25 2023 [23] CWE ID 094

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001764, CCI-001774, CCI-002754

[14] Standards Mapping - FIPS200 SI

[15] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[16] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[17] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[18] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input

[19] Standards Mapping - OWASP Top 10 2021 A03 Injection

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.2 Configuration Architectural Requirements (L2 L3), 5.2.5 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.8 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.3.6 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 10.3.2 Deployed Application Integrity Controls (L1 L2 L3), 12.3.3 File Execution Requirements (L1 L2 L3), 14.2.3 Dependency (L1 L2 L3)

[21] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection

[22] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[23] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.1

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[35] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 116, Risky Resource Management - CWE ID 094

[36] Standards Mapping - SANS Top 25 2010 Risky Resource Management - CWE ID 494

[37] Standards Mapping - SANS Top 25 2011 Risky Resource Management - CWE ID 494

[38] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3570 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3570 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3570 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3570 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3570 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3570 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3570 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[55] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[56] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[57] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[58] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[59] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Process Validation (WASC-40), Improper Input Handling (WASC-20)

desc.dataflow.java.dynamic_code_evaluation_code_manipulation