Reino: Input Validation and Representation

Problemas de validação e representação da entrada são causados por metacaracteres, codificações alternativas e representações numéricas. Confiar na entrada resulta em problemas de segurança. Os problemas incluem: “Buffer Overflows”, ataques de “Cross-Site Scripting”, “SQL Injection”, entre outros.

Denial of Service: Format String

Java/JSP

Abstract

Permitir que a entrada do usuário controle parâmetros de formato pode permitir que um invasor provoque o lançamento de exceções ou o vazamento de informações.

Explanation

Os invasores podem ser capazes de modificar o argumento de string de formato de modo que uma exceção seja lançada. Se essa exceção não for capturada, o aplicativo poderá travar. Como alternativa, se informações confidenciais forem usadas dentro de outros argumentos, os invasores poderão alterar a string de formato de forma a revelar essas informações.

Exemplo 1: O código a seguir permite que um usuário especifique o argumento de string de formato para Formatter.format().


  ...
  Formatter formatter = new Formatter(Locale.US);
  String format = "The customer: %s %s has the balance %4$." + userInput + "f";
  formatter.format(format, firstName, lastName, accountNo, balance);
  ...

A intenção desse programa é permitir que o usuário especifique os pontos decimais nos quais ele mostra o equilíbrio. Porém, na realidade, não há restrições para isso. Se o usuário puder especificar qualquer coisa, isso poderá resultar no lançamento de uma exceção, como java.util.MissingFormatArgumentException, e, por não estar dentro de um bloco "try", essa exceção pode provocar falhas no aplicativo.
Ainda mais crítico neste exemplo, se um invasor puder especificar o a entrada de usuário "2f %3$s %4$.2", a string de formato seria "The customer: %s %s has the balance %4$.2f %3$s %4$.2". Por sua vez, isso faria com que as informações confidenciais de accountNo fossem incluídas na string resultante.

References

[1] IDS06-J. Exclude unsanitized user input from format strings CERT

[2] Standards Mapping - Common Weakness Enumeration CWE ID 730

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094, CCI-001310

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1), SI-10 Information Input Validation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection, SI-10 Information Input Validation

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[8] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[9] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[10] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[11] Standards Mapping - OWASP Top 10 2013 A1 Injection

[12] Standards Mapping - OWASP Top 10 2017 A1 Injection

[13] Standards Mapping - OWASP Top 10 2021 A03 Injection

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[24] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[46] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[47] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.dataflow.java.denial_of_service_format_string