Reino: Input Validation and Representation

Problemas de validação e representação da entrada são causados por metacaracteres, codificações alternativas e representações numéricas. Confiar na entrada resulta em problemas de segurança. Os problemas incluem: “Buffer Overflows”, ataques de “Cross-Site Scripting”, “SQL Injection”, entre outros.

Cross-Site Flashing

ActionScript

Abstract

O programa usa uma entrada de usuário não validada para carregar um arquivo SWF, o que pode fazer com que um conteúdo arbitrário seja referenciado e possivelmente executado pelo aplicativo Flash intencionado.

Explanation

APIs Flash fornecem uma interface para carregar arquivos SWF remotos no ambiente de execução existente. Mesmo que a política entre domínios definida só permita o carregamento de arquivos SWF a partir de uma lista de domínios confiáveis, na maioria dos casos, ela é excessivamente permissiva. Permitir que uma entrada de usuário não confiável defina quais arquivos SWF devem ser carregados pode fazer com que um conteúdo arbitrário seja referenciado e possivelmente executado pelo aplicativo intencionado, resultando em um ataque de criação de flash entre sites.

Vulnerabilidades de criação de flash entre sites ocorrem quando:

1. Os dados entram no aplicativo por uma fonte não confiável.

2. Os dados são usados para carregar um arquivo SWF remoto.
Exemplo: O código a seguir usa o valor de um dos parâmetros para o arquivo SWF carregado como a URL a partir da qual carregar um arquivo SWF remoto.


   ...
   var params:Object = LoaderInfo(this.root.loaderInfo).parameters;
   var url:String = String(params["url"]);
   var ldr:Loader = new Loader();
   var urlReq:URLRequest = new URLRequest(url);
   ldr.load(urlReq);
   ...

References

[1] Peleus Uhley Creating more secure SWF web applications

[2] Matt Wood and Prajakta Jagdale Auditing Adobe Flash through Static Analysis

[3] Standards Mapping - Common Weakness Enumeration CWE ID 494, CWE ID 829

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001167

[5] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-18 Mobile Code (P2), SI-10 Information Input Validation (P1)

[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-18 Mobile Code, SI-10 Information Input Validation

[8] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.2 Configuration Architectural Requirements (L2 L3), 5.3.9 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 10.3.2 Deployed Application Integrity Controls (L1 L2 L3), 12.3.3 File Execution Requirements (L1 L2 L3), 12.3.6 File Execution Requirements (L2 L3), 14.2.3 Dependency (L1 L2 L3), 14.2.4 Dependency (L2 L3)

[9] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection

[10] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[11] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[12] Standards Mapping - OWASP Top 10 2021 A08 Software and Data Integrity Failures

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[24] Standards Mapping - SANS Top 25 2009 Risky Resource Management - CWE ID 494

[25] Standards Mapping - SANS Top 25 2010 Risky Resource Management - CWE ID 494

[26] Standards Mapping - SANS Top 25 2011 Risky Resource Management - CWE ID 494, Risky Resource Management - CWE ID 829

[27] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-003300 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-003300 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-003300 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-003300 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-003300 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-003300 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-003300 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-003300 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-003300 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-003300 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-003300 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-003300 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-003300 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II, APSC-DV-003300 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002530 CAT II, APSC-DV-003300 CAT II

[42] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.dataflow.actionscript.cross_site_flashing