계: Security Features

소프트웨어 보안은 보안 소프트웨어가 아닙니다. 여기서는 인증, 액세스 제어, 기밀성, 암호화, 권한 관리 등의 항목에 대해 설명합니다.

312 개 항목 찾음

취약점

ASP.NET Misconfiguration: Logging Sensitive Information

C#/VB.NET/ASP.NET

Abstract

잘못 구성된 W3Clogger 미들웨어로 인해 중요한 정보가 로깅될 수 있습니다.

Explanation

개인 정보, 시스템 정보 등의 중요한 데이터 로깅을 허용하도록 ASP.NET W3Clogger.loggingFields를 구성할 수 있습니다.
이 데이터에는 HTTP 요청 및 HTTP 응답과 관련된 중요한 정보(예: 클라이언트/서버 IP, 서버 포트, 헤더 크키, 서버에 액세스한 인증된 사용자 이름)가 포함될 수 있습니다.
데이터 보안이 위반되면 공격자가 이 정보를 사용하여 다음과 같은 작업을 수행할 수 있습니다.
- 중요한 정보 도용 또는 권한 수준이 더 높은 사용자 가장
- 내부 서버 검색 및 제한된 리소스 무단 액세스 권한 확보
- 탐지된 서버를 대상으로 보고된 알려진 취약점 악용에 주력하는 공격 진행
예제 1: 다음 코드는 확인이 비활성화된 컨트롤러의 작업 메서드를 보여줍니다.


  builder.Services.AddW3CLogging(logging =>
    logging.LoggingFields = W3CLoggingFields.All;
    ... )

Example 1All 플래그를 사용해 ClientIpAddress, ServerName, ServerIpAddress, ServerPort, UserName, Cookie 등의 중요한 데이터를 비롯하여 Http 요청에 포함될 수 있는 모든 필드를 로깅하도록 W3Clogging을 구성하는 방법을 보여줍니다.

References

[1] Building Secure ASP.NET Pages and Controls Microsoft

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 2

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark partial

[7] Standards Mapping - Common Weakness Enumeration CWE ID 5

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000068, CCI-001453, CCI-002418, CCI-002420, CCI-002421, CCI-002422, CCI-002890, CCI-003123

[9] Standards Mapping - FIPS200 CM, SC

[10] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-8 Transmission Confidentiality and Integrity (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-8 Transmission Confidentiality and Integrity

[13] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[14] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[15] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[16] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[19] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.2.5 General Authenticator Requirements (L3), 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 6.2.1 Algorithms (L1 L2 L3), 8.1.6 General Data Protection (L3), 8.3.1 Sensitive Private Data (L1 L2 L3), 9.1.1 Communications Security Requirements (L1 L2 L3), 9.2.2 Server Communications Security Requirements (L2 L3), 14.1.3 Build (L2 L3), 14.4.5 HTTP Security Headers Requirements (L1 L2 L3)

[21] Standards Mapping - OWASP Mobile 2014 M3 Insufficient Transport Layer Protection

[22] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography, Control Objective C.4.1 - Web Software Communications

[34] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260.1 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[55] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Transport Layer Protection (WASC-04)

[56] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.structural.dotnet.asp_dotnet_misconfiguration_logging_sensitive_information

ASP.NET Misconfiguration: Persistent Authentication

C#/VB.NET/ASP.NET

Abstract

Persistent authentication 티켓은 사용자를 세션 하이재킹에 취약하게 합니다.

Explanation

FormsAuthentication.RedirectFromLoginPage() 메서드는 지정된 시간 동안 사용자를 인증 상태로 유지하는 authentication 티켓을 발행합니다. 이 메서드가 두 번째 인수 false와 함께 호출되면 이 메서드는 web.config에 지정된 시간 동안 유효한 임시 authentication 티켓을 발행합니다. 두 번째 인수 true와 함께 호출되면 이 메서드는 persistent authentication 티켓을 발행합니다. .NET 2.0에서 persistent authentication 티켓의 수명은 web.config의 값을 따르지만 .NET 1.1에서 persistent authentication 티켓은 지나치게 긴 수명 값(예: 50년)을 가집니다.

persistent authentication 티켓을 장시간 동안 유효하도록 허용하면 사용자 및 시스템에 다음과 같은 취약점이 나타납니다.

로그아웃에 실패한 사용자가 세션 하이재킹 공격에 노출되는 기간이 연장됩니다.

공격자가 추측에 사용할 수 있는 유효한 세션 식별자의 평균 수가 증가합니다.

공격자가 사용자 세션의 하이재킹에 성공하면 익스플로이트 기간이 늘어납니다.

References

[1] Jeff Prosise The Keep Sites Running Smoothly By Avoiding These 10 Common ASP.NET Pitfalls MSDN Magazine

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 302

[8] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[9] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[10] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[11] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[12] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001185, CCI-001941, CCI-001942

[14] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[15] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-23 Session Authenticity (P1)

[16] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-23 Session Authenticity

[17] Standards Mapping - OWASP Top 10 2004 A3 Broken Authentication and Session Management

[18] Standards Mapping - OWASP Top 10 2007 A7 Broken Authentication and Session Management

[19] Standards Mapping - OWASP Top 10 2010 A3 Broken Authentication and Session Management

[20] Standards Mapping - OWASP Top 10 2013 A2 Broken Authentication and Session Management

[21] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication

[22] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[23] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[24] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.10.1 Service Authentication Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[25] Standards Mapping - OWASP Mobile 2014 M9 Improper Session Handling

[26] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[37] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[38] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3405 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3405 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3405 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3405 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3405 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3405 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3405 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[55] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[56] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[57] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[58] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001530 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[59] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authentication (WASC-01)

[60] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.config.dotnet.asp_dotnet_misconfiguration_persistent_authentication

ASP.NET Misconfiguration: Unsafe Header Parsing

C#/VB.NET/ASP.NET

Abstract

응용 프로그램은 HTTP 구문 분석 중 검증 오류를 일으키는 속성이 무시되도록 설정합니다.

Explanation

useUnsafeHeaderParsing을 true로 설정하면 HTTP 헤더의 처리가 완화됩니다. HTTP 헤더에 대한 검증 규칙이 지나치게 허용적인 경우 취약한 응용 프로그램에 대한 다양한 공격을 허용할 수 있습니다.

특히 이 속성이 false로 설정되면 다음 검증 규칙이 더 이상 적용되지 않습니다.

줄 끝 코드에서 CRLF를 사용하십시오. CR 또는 LF만 사용하는 것은 허용되지 않습니다.

헤더 이름에는 공백이 없어야 합니다.

상태 줄이 여러 개인 경우 모든 추가 상태 줄은 형식이 잘못된 헤더 이름/값 쌍으로 처리됩니다.

상태 에는 상태 코드에 더해 상태 설명이 있어야 합니다.

헤더 이름에는 ASCII가 아닌 문자가 포함될 수 없습니다. 이 검증은 이 속성이 true 또는 false로 설정되었는지 여부와 관계없이 수행됩니다.

프로토콜 위반이 발생하면 WebException 예외가 발생하고 상태가 ServerProtocolViolation으로 설정됩니다. UseUnsafeHeaderParsing 속성이 true로 설정되면 검증 오류가 무시됩니다.

이 속성을 true로 설정하면 보안에 영향을 미치므로 이전 서버 버전과의 호환성이 필요한 경우에만 수행해야 합니다.

예제 1: 다음 예에서, useUnsafeHeaderParsing이 true로 설정됩니다.


...
<configuration>
   <system.net>
   <settings>
      <httpWebRequest  useUnsafeHeaderParsing="true" />
   </settings>
   </system.net>
</configuration>
...

References

[1] HttpWebRequestElement.UseUnsafeHeaderParsing Property Microsoft

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 113

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754

[9] Standards Mapping - FIPS200 CM

[10] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[13] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[14] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[16] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[18] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[19] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[20] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective C.3.1 - Web Software Attack Mitigation

[32] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002560 CAT I

[53] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.config.dotnet.asp_dotnet_misconfiguration_unsafe_header_parsing

ASP.NET Misconfiguration: ViewStateMac Disabled

C#/VB.NET/ASP.NET

Abstract

보기 상태 MAC(메시지 인증 확인)를 비활성화하면 공격자가 보기 상태를 수정할 수 있습니다.

Explanation

ASP.NET에서 보기 상태는 포스트백에서 웹 양식의 상태를 유지하는 메커니즘입니다. 보기 상태에 저장된 데이터는 재생 공격을 방지하는 메커니즘이 없기 때문에 신뢰할 수 없습니다. 보기 상태를 신뢰하는 것은 보기 상태 메시지 인증 확인이 비활성화된 경우 특히 위험합니다. 이 검사를 비활성화하면 공격자가 보기 상태에 저장된 데이터를 임의로 변경할 수 있으며 보기 상태를 신뢰하는 코드를 공격할 기회를 공격자에게 제공할 수 있습니다. 공격자는 이러한 종류의 오류를 사용하여 인증 확인을 무효화하거나 항목 가격을 변경할 수 있습니다.

References

[1] Understanding ASP.NET View State Microsoft

[2] Michal Zalewski ASP.NET __VIEWSTATE crypto validation prone to replay attacks

[3] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[7] Standards Mapping - CIS Kubernetes Benchmark complete

[8] Standards Mapping - Common Weakness Enumeration CWE ID 353

[9] Standards Mapping - FIPS200 CM

[10] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[11] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[12] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[14] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[16] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[17] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.5.3 Token-based Session Management (L2 L3), 10.3.2 Deployed Application Integrity Controls (L1 L2 L3)

[18] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[19] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 2.2.3

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 2.2.3

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 2.2.3

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 2.2.4

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 2.2.4

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 2.2.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 2.2.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 2.2.6

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 2.2 - Secure Defaults

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 2.2 - Secure Defaults

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 2.2 - Secure Defaults

[31] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

[32] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.config.dotnet.asp_dotnet_misconfiguration.viewstatemac_disabled

ASP.NET MVC Bad Practices: Controller Action Without AntiForgery Validation

C#/VB.NET/ASP.NET

Abstract

컨트롤러 작업에서 antiforgery 확인 기능을 활용할 수 있습니다.

Explanation

ASP.NET MVC는 폼 측에 antiforgery 토큰을 추가하고 컨트롤러에서 이 antiforgery 토큰을 확인하여 cross-site request forgery로부터 응용 프로그램을 보다 효율적으로 보호하는 편리한 방법을 제공합니다. 이 토큰은 사용 시 보통 숨겨진 폼 필드로 포함되고 폼 전송 시 확인되기 때문에 요청이 응용 프로그램에서 보낸 것이며 위조되지 않은 것일 가능성이 높아집니다.

다음 컨트롤러 코드에는 기본 제공되는 cross-site request forgery 방어 기법이 포함되어 있지 않습니다.


public ActionResult ActionName(Model model, string returnurl)
{
  // ... controller logic
}

References

[1] HtmlHelper.AntiForgeryToken Method

[2] ValidateAntiForgeryTokenAttribute Class

[3] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[4] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[5] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[6] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[7] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[8] Standards Mapping - CIS Kubernetes Benchmark complete

[9] Standards Mapping - Common Weakness Enumeration CWE ID 352

[10] Standards Mapping - Common Weakness Enumeration Top 25 2019 [9] CWE ID 352

[11] Standards Mapping - Common Weakness Enumeration Top 25 2020 [9] CWE ID 352

[12] Standards Mapping - Common Weakness Enumeration Top 25 2021 [9] CWE ID 352

[13] Standards Mapping - Common Weakness Enumeration Top 25 2022 [9] CWE ID 352

[14] Standards Mapping - Common Weakness Enumeration Top 25 2023 [9] CWE ID 352

[15] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001310, CCI-001941, CCI-001942

[16] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[17] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-23 Session Authenticity (P1)

[18] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-23 Session Authenticity

[19] Standards Mapping - OWASP Top 10 2007 A5 Cross Site Request Forgery (CSRF)

[20] Standards Mapping - OWASP Top 10 2010 A5 Cross-Site Request Forgery (CSRF)

[21] Standards Mapping - OWASP Top 10 2013 A8 Cross-Site Request Forgery (CSRF)

[22] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[23] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.5.3 Token-based Session Management (L2 L3), 4.2.2 Operation Level Access Control (L1 L2 L3), 13.2.3 RESTful Web Service Verification Requirements (L1 L2 L3)

[24] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[25] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.5

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.9

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.9

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.9

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.9

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.9

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.3 - Authentication and Access Control

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.3 - Authentication and Access Control

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.3 - Authentication and Access Control, Control Objective C.2.1.2 - Web Software Access Controls

[36] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 352

[37] Standards Mapping - SANS Top 25 2010 Insecure Interaction - CWE ID 352

[38] Standards Mapping - SANS Top 25 2011 Insecure Interaction - CWE ID 352

[39] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3585 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3585 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3585 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3585 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3585 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3585 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3585 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[60] Standards Mapping - Web Application Security Consortium Version 2.00 Cross-Site Request Forgery (WASC-09)

[61] Standards Mapping - Web Application Security Consortium 24 + 2 Cross-Site Request Forgery

desc.structural.dotnet.aspnet_mvc_bad_practices_action_without_antiforgery_validation

ASP.NET MVC Bad Practices: Form Without AntiForgery Token

C#/VB.NET/ASP.NET

Abstract

Razor 보기가 폼은 포함하지만 해당 폼을 사용하는 antiforgery 토큰은 포함하지 않아서 cross-site request forgery에 보다 취약할 수 있습니다.

Explanation

ASP.NET MVC는 HTML 폼에 antiforgery 토큰을 추가하고 컨트롤러에서 해당 antiforgery 토큰을 확인하여 cross-site request forgery로부터 응용 프로그램을 보다 효율적으로 보호하는 편리한 방법을 제공합니다. 이 토큰은 사용 시 보통 숨겨진 폼 필드로 포함되고 폼 전송 시 확인되기 때문에 요청이 응용 프로그램에서 보낸 것이며 위조되지 않은 것일 가능성이 높아집니다.

일반적으로 프로그래머는 이 antiforgery 토큰을 포함해야 합니다. 그러면 응용 프로그램에 대한 악성 스크립팅이 더 어려워지기 때문입니다.

예제 1: 다음 Razor 코드는 기본 제공 교차 사이트 요청 위조 방어 기능을 추가하지 않고 결과 HTML에 양식을 만듭니다.


@using (Html.BeginForm(new { ReturnUrl = ViewBag.ReturnUrl })) {
  // ... form elements
}

Example 2::The following Razor code creates a form in the resulting HTML without the built-in defense against cross-site request forgery. Note that parameter antiforgery is set to either false or null:


@using (Html.BeginForm("actionName", "controllerName", routeValues, FormMethod.Post, antiforgery: false, htmlAtts)) {
  // ... form elements
}

References

[1] HtmlHelper.AntiForgeryToken Method

[2] ValidateAntiForgeryTokenAttribute Class

[3] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[4] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[5] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4