1437 개 항목 찾음

취약점

Access Control: Unenforced Sharing Rules

Apex

Abstract

Apex 클래스에는 사용자 공유 규칙을 적용하지 않고 실행할 수 있는 데이터베이스 작업이 포함되어 있습니다.

Explanation

Salesforce 응용 프로그램은 공유 규칙을 사용하여 사용자 권한 및 데이터베이스 레코드에 대한 액세스를 제어합니다. 그러나 Apex에서 사용자 공유 규칙이 항상 적용되는 것은 아닙니다. 규칙이 적용되는 방식을 변경하는 다른 공유 키워드를 사용하여 Apex 클래스를 선언할 수 있기 때문입니다. 다음의 세 가지 공유 키워드 중 하나로 클래스를 선언할 수 있습니다.

- with sharing: 사용자 공유 규칙이 적용됩니다.
- without sharing: 공유 규칙이 적용되지 않습니다.
- inherited sharing: 호출 클래스의 공유 규칙이 적용됩니다. 호출 클래스가 공유 키워드를 지정하지 않거나 클래스 자체가 Visualforce 컨트롤러와 같은 진입점인 경우에는 사용자 공유 규칙이 기본적으로 적용됩니다.

공유 키워드가 선언되어 있지 않으면 클래스는 호출 클래스의 공유 모드(있는 경우)를 상속합니다. 그 외의 경우에는 공유 규칙이 적용되지 않습니다.

예제 1: 다음 3개 Apex 클래스에는 모두 데이터베이스 쿼리 호출용으로 안전하지 않은 공유 키워드가 포함되어 있습니다.


    public class MyClass1 {
        public List<Contact> getAllTheSecrets() {
            return Database.query('SELECT Name FROM Contact');
        }
    }

    public without sharing class MyClass2 {
        public List<Contact> getAllTheSecrets() {
            return Database.query('SELECT Name FROM Contact');
        }
    }

    public inherited sharing class MyClass3 {
        public List<Contact> getAllTheSecrets() {
            return Database.query('SELECT Name FROM Contact');
        }
    }

MyClass1 및 MyClass2가 안전하지 않은 이유는 사용자 공유 규칙을 적용하지 않고도 레코드를 검색할 수 있기 때문입니다.

MyClass3의 경우에는 기본적으로 공유 규칙을 적용하므로 더 안전합니다. 그러나 without sharing을 명시적으로 선언하는 클래스에서 getAllTheSecrets() 함수를 호출하는 경우에는 여전히 무단 액세스 권한을 부여할 수 있습니다.

References

[1] Using the with sharing, without sharing, and inherited sharing Keywords Salesforce

[2] Sharing Rules Considerations Salesforce

[3] Standards Mapping - Common Weakness Enumeration CWE ID 566

[4] Standards Mapping - Common Weakness Enumeration Top 25 2023 [24] CWE ID 863

[5] Standards Mapping - Common Weakness Enumeration Top 25 2024 [18] CWE ID 863

[6] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084, CCI-002165

[7] Standards Mapping - FIPS200 AC

[8] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), SC-3 Security Function Isolation (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, SC-3 Security Function Isolation

[11] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.1.2 General Access Control Design (L1 L2 L3), 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3), 13.4.2 GraphQL and other Web Service Data Layer Security Requirements (L2 L3)

[12] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[13] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[14] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[15] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[16] Standards Mapping - OWASP Top 10 2007 A4 Insecure Direct Object Reference

[17] Standards Mapping - OWASP Top 10 2010 A4 Insecure Direct Object References

[18] Standards Mapping - OWASP Top 10 2013 A4 Insecure Direct Object References

[19] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control

[20] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.4

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[33] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 863

[34] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.1 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.1 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.1 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.1 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.1 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.1 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.1 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[56] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[57] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.structural.apex.access_control_unenforced_sharing_rules

Access Control: Weak Security Constraint

Java/JSP

Abstract

약한 보안 제약 조건은 보안에 중요한 리소스에 대한 적절한 보호를 제공하지 않습니다.

Explanation

단일 <security constraint> 요소는 프로그램에 RBAC(Role-Based Access Control)가 사용되고 있지 않음을 암시합니다. RBAC는 보안 웹 응용 프로그램에서 민감한 작업의 보호를 위해 널리 용인되는 모범 사례입니다. 민감한 작업 또는 데이터에 대한 액세스를 제공하는 응용 프로그램의 경우 권한이 없는 사용자의 액세스를 차단하는 충분한 제어가 없을 수 있습니다. 또한 <url-pattern>에 와일드카드(*)가 있는 경우 패턴이 지나치게 광범위하다는 표시일 수 있습니다.

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 285

[2] Standards Mapping - Common Weakness Enumeration Top 25 2023 [24] CWE ID 863

[3] Standards Mapping - Common Weakness Enumeration Top 25 2024 [18] CWE ID 863

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084, CCI-002165

[5] Standards Mapping - FIPS200 AC

[6] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), CM-5 Access Restrictions for Change (P1), SC-3 Security Function Isolation (P1)

[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, CM-5 Access Restrictions for Change, SC-3 Security Function Isolation

[9] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[10] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3), 13.1.4 Generic Web Service Security Verification Requirements (L2 L3)

[11] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[12] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[13] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2007 A10 Failure to Restrict URL Access

[15] Standards Mapping - OWASP Top 10 2010 A8 Failure to Restrict URL Access

[16] Standards Mapping - OWASP Top 10 2013 A7 Missing Function Level Access Control

[17] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control

[18] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2, Requirement 7.2

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.5, Requirement 6.5.10, Requirement 7.2

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8, Requirement 7.2

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8, Requirement 7.2

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8, Requirement 7.2

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8, Requirement 7.2

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8, Requirement 7.2

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 7.3.1

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 7.3.1

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[31] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[32] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[33] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 863

[34] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3470.1 CAT II, APP3470.4 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3470.1 CAT II, APP3470.4 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3470.1 CAT II, APP3470.4 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3470.1 CAT II, APP3470.4 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3470.1 CAT II, APP3470.4 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3470.1 CAT II, APP3470.4 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3470.1 CAT II, APP3470.4 CAT II