531 개 항목 찾음

취약점

ADF Bad Practices: Missing URL Parameter Converter

Java/JSP

Abstract

Oracle ADF Faces의 책갈피 지정 가능한 보기에 URL 매개 변수 변환기가 없습니다.

Explanation

정규 JSF 응용 프로그램에서는 지정한 변환기 및 유효성 검사기를 사용하여 UI 구성 요소가 값을 변환하고 확인합니다. 변환 및 검증은 페이지가 제출될 때 발생합니다. Fusion 응용 프로그램에서 책갈피 지정 가능한 보기는 페이지 제출로 연결되지 않으므로 기본적으로 유사한 변환 또는 검증이 수행되지 않습니다.

예제 1: 다음 구성 파일 조각은 paramName URL 매개 변수의 변환 또는 검증을 수행하지 않도록 구성된 책갈피 지정 가능한 보기의 샘플을 보여줍니다.


...
    <bookmark>
        <method>#{paramHandler.handleParams}</method>
        <url-parameter>
            <name>paramName</name>
            <value>#{requestScope.paramName}</value>
        </url-parameter>
    </bookmark>
...

References

[1] Oracle(R) Fusion Middleware Fusion Developer's Guide for Oracle Application Development Framework, 15.2.3.Bookmarking View Activities

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.5

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 20

[8] Standards Mapping - Common Weakness Enumeration Top 25 2021 [4] CWE ID 020

[9] Standards Mapping - Common Weakness Enumeration Top 25 2022 [4] CWE ID 020

[10] Standards Mapping - Common Weakness Enumeration Top 25 2023 [6] CWE ID 020

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754

[12] Standards Mapping - FIPS200 CM

[13] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[14] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[15] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[16] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.1.3 Input Validation Requirements (L1 L2 L3), 5.1.4 Input Validation Requirements (L1 L2 L3)

[21] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[22] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 2.2.6

[26] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[29] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I

[30] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I

[31] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I

[32] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[50] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.config.java.adf_bad_practices_missing_url_parameter_converter

ADF Faces Bad Practices: unsecure Attribute

Java/JSP

Abstract

unsecure 속성은 클라이언트에서 그 값이 설정될 수 있는 속성의 목록을 지정합니다.

Explanation

Oracle ADF Faces 구성 요소의 속성 값은 대개 서버에서만 설정될 수 있습니다. 그러나 구성 요소가 많으면 개발자가 클라이언트에서 설정될 수 있는 속성의 목록을 정의할 수 있습니다. 이러한 구성 요소의 unsecure 속성은 그러한 목록을 지정할 수 있습니다.

현재 unsecure 속성 내에 나타날 수 있는 유일한 속성은 disabled이며, 이는 활성화되는 구성 요소와 그렇지 않은 구성 요소를 클라이언트가 정의하도록 허용합니다. 서버에서만 설정할 수 있는 속성의 값을 클라이언트가 제어하도록 하는 것은 좋은 방법이 아닙니다.

예제: 다음 코드는 사용자에게서 암호 정보를 수집하고 unsecure 속성을 사용하는 inputText 구성 요소를 보여줍니다.


...
    <af:inputText id="pwdBox"
                  label="#{resources.PWD}"
                  value=""#{userBean.password}
                  unsecure="disabled"
                  secret="true"
                  required="true"/>
...

References

[1] Oracle ADF Faces Tag Reference

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 5

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - CIS Kubernetes Benchmark partial

[7] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

desc.structural.java.adf_faces_bad_practices_unsecure_attribute

Android Bad Practices: Encryption Secret Held in Static Field

Java/JSP

Abstract

응용 프로그램이 정적 클래스 필드에 암호화 키를 유지하며, 이로 인해 공격자가 암호화 키를 쉽게 복구할 수 있습니다.

Explanation

암호화 키를 정적 클래스 필드에 저장하면 프로세스 메모리(예: 루팅된 장치) 또는 프로세스 메모리 덤프(예: 크래시 덤프)에 액세스할 수 있는 엔터티가 쉽게 복구할 수 있습니다.

References

[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[2] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.1

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - CIS Kubernetes Benchmark partial

[7] Standards Mapping - Common Weakness Enumeration CWE ID 226

[8] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200

[9] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200

[10] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001090, CCI-001199

[12] Standards Mapping - FIPS200 IA

[13] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[14] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1), SC-4 Information in Shared Resources (P1)

[15] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement, SC-4 Information in Shared System Resources

[16] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[17] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[18] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[19] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[20] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[21] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design

[22] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.3.4 Sensitive Private Data (L1 L2 L3), 8.3.6 Sensitive Private Data (L2 L3)

[23] Standards Mapping - OWASP Mobile 2014 M4 Unintended Data Leakage

[24] Standards Mapping - OWASP Mobile 2024 M10 Insufficient Cryptography

[25] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-STORAGE-2

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 3.4, Requirement 6.5.8, Requirement 8.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.8, Requirement 8.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 3.4, Requirement 6.5.3, Requirement 8.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 3.5.1, Requirement 6.2.4, Requirement 8.3.1

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7.2 - Use of Cryptography

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7.2 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7.2 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3230.2 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3230.2 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3230.2 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3230.2 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3230.2 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3230.2 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3230.2 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002330 CAT II, APSC-DV-002380 CAT II

[58] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[59] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.structural.java.android_bad_practices_encryption_secret_held_in_static_field

Android Bad Practices: Just Provider writePermission Defined

Java/JSP

Abstract

이 프로그램은 writePermission만 정의된 콘텐트 공급자를 선언합니다.

Explanation

콘텐트 공급자에 대해 개별 읽기 및 쓰기 권한을 정의하는 것이 좋지만 writePermission만 정의하면 오해의 소지가 있을 수 있습니다. SQL의 특성상 진정한 쓰기 전용 쿼리를 생성하는 것은 일반적으로 불가능합니다. 사용자가 데이터에 액세스할 수 없는 경우에도 공격자는 where 절을 조작하여 저장된 데이터를 재구성할 수 있습니다.

예제: 다음은 writePermission으로만 선언된 콘텐트 공급자의 예입니다.

 <provider android:name=".ContentProvider" android:writePermission="content.permission.WRITE_CONTENT"/>

References

[1] Provider Element

[2] Path Permission Element

[3] Security tips - Use permissions

[4] Jesse Burns Developing Secure Mobile Applications for Android

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[6] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[7] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[8] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[9] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[10] Standards Mapping - Common Weakness Enumeration CWE ID 265

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[12] Standards Mapping - FIPS200 AC

[13] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[14] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[15] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[16] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[17] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[21] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3)

[22] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[23] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[24] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control

[35] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[36] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.2 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.2 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.2 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.2 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.2 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.2 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.2 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[58] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.config.java.android_bad_practices_just_provider_writepermission_defined

Android Bad Practices: Leftover Debug Code

Java/JSP

Abstract

디버그 코드는 성능에 영향을 미치거나 민감한 데이터를 공격자에게 유출할 수 있습니다.

Explanation

일반적인 개발 방법은 응용 프로그램으로 발표하거나 배포하지는 않고 디버깅 및 테스트 목적으로만 특별 디자인된 "비밀" 코드를 추가하는 것입니다. 이 비밀 디버그 코드가 실수로 응용 프로그램에 남아 있게 되면 응용 프로그램은 예기치 않은 상호 작용 모드에 노출됩니다. 이 비밀 진입점은 디자인이나 테스트 도중 고려되지 않고 응용 프로그램의 예상 동작 조건 범위를 벗어나기 때문에 보안 위험을 야기합니다.

References

[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[2] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[3] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[4] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[5] Standards Mapping - Common Weakness Enumeration CWE ID 489

[6] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[7] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[8] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[9] Standards Mapping - OWASP Application Security Verification Standard 4.0 14.2.2 Dependency (L1 L2 L3), 14.3.2 Unintended Security Disclosure Requirements (L1 L2 L3)

[10] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-RESILIENCE-4

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.6

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention

[22] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II

desc.structural.java.android_bad_practices_leftover_debug_code

Android Bad Practices: Missing Broadcaster Permission

Java/JSP

Abstract

프로그램은 브로드캐스터 권한을 지정하지 않고 수신자를 등록합니다.

Explanation

브로드캐스터 권한 없이 등록된 수신자는 임의의 브로드캐스터에게서 메시지를 수신합니다. 이러한 메시지가 악성 데이터를 포함하고 있거나 악의적인 브로드캐스터에게서 온 것일 경우, 응용 프로그램에 위험을 끼칠 수 있습니다.

예제 1: 다음 코드는 브로드캐스터 권한을 지정하지 않고 수신자를 등록합니다.


...
context.registerReceiver(broadcastReceiver, intentFilter);
...

References

[1] Using Permissions

[2] Jesse Burns Developing Secure Mobile Applications for Android

[3] William Enck, Machigar Ongtang, and Patrick McDaniel Understanding Android Security

[4] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[5] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 265, CWE ID 925, CWE ID 926

[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001368, CCI-001414

[11] Standards Mapping - FIPS200 AC

[12] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[13] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1)

[14] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement

[15] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[16] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3), 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3)

[21] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[22] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[23] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.6, Requirement 7.1.1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5