Reino: Environment

Esta seção contém tudo o que fica fora do código-fonte, porém que é essencial para a segurança do produto que está sendo criado. Como os problemas tratados neste domínio não são diretamente relacionados com o código-fonte, nós o separamos dos demais domínios.

External Content: Content Delivery Network

C#/VB.NET/ASP.NET

Abstract

Depender de uma CDN para fornecer o código essencial diretamente aos usuários pode resultar na execução de código mal-intencionado.

Explanation

Usar uma CDN para servir um aplicativo dependente de JavaScript oferece muito mais vantagens que servir o JavaScript do próprio servidor do aplicativo. Essas vantagens incluem a melhoria do desempenho e a redução da manutenção do código para o proprietário do aplicativo. No entanto, o aplicativo supõe que a CDN distribuirá conteúdo seguro para o navegador. Se um invasor comprometer uma CDN, ela enviará código mal-intencionado ao navegador do usuário. O navegador do usuário passará a executar um código que o aplicativo não pode controlar ou detectar como mal-intencionado.

Exemplo 1: O código ASPX a seguir inclui o código jQuery da Microsoft referenciando a Microsoft CDN:


...
<script src="http://ajax.microsoft.com/ajax/jquery/jquery-1.4.2.min.js" type="text/javascript"></script>
...

Exemplo 2: O código ASPX a seguir permite o redirecionamento automático de todas as solicitações de script da estrutura ASP.NET à Microsoft Ajax CDN:


...
<asp:ScriptManager
   ID="ScriptManager1"
   EnableCdn="true"
   Runat="Server" />
...

No Example 2, o controle ScriptManager configura sua página ASPX para redirecionar automaticamente qualquer solicitação de script à CDN apropriada.

References

[1] Content Deliver Network and its Regulation The Journal of China Universities of Posts and Telecommunications

[2] Managed Content Security Delivery radware

[3] Standards Mapping - Common Weakness Enumeration CWE ID 94, CWE ID 98

[4] Standards Mapping - Common Weakness Enumeration Top 25 2019 [18] CWE ID 094

[5] Standards Mapping - Common Weakness Enumeration Top 25 2020 [17] CWE ID 094

[6] Standards Mapping - Common Weakness Enumeration Top 25 2022 [25] CWE ID 094

[7] Standards Mapping - Common Weakness Enumeration Top 25 2023 [23] CWE ID 094

[8] Standards Mapping - Common Weakness Enumeration Top 25 2024 [11] CWE ID 094

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001167

[10] Standards Mapping - FIPS200 SI

[11] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[12] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-18 Mobile Code (P2)

[13] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-18 Mobile Code

[14] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.2.5 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.8 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.3.6 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 5.3.9 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 10.3.2 Deployed Application Integrity Controls (L1 L2 L3), 12.3.3 File Execution Requirements (L1 L2 L3), 12.3.6 File Execution Requirements (L2 L3), 14.2.4 Dependency (L2 L3)

[15] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection

[16] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input

[17] Standards Mapping - OWASP Top 10 2007 A3 Malicious File Execution

[18] Standards Mapping - OWASP Top 10 2010 A1 Injection

[19] Standards Mapping - OWASP Top 10 2013 A1 Injection

[20] Standards Mapping - OWASP Top 10 2017 A1 Injection

[21] Standards Mapping - OWASP Top 10 2021 A03 Injection

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.3

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[31] Standards Mapping - SANS Top 25 2009 Risky Resource Management - CWE ID 094

[32] Standards Mapping - SANS Top 25 2010 Risky Resource Management - CWE ID 098

[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3600 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3600 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3600 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3600 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3600 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3600 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3600 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-003300 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-003300 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-003300 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-003300 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-003300 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-003300 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-003300 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-003300 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-003300 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-003300 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-003300 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-003300 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-003300 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-003300 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-003300 CAT II

[55] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.semantic.dotnet.external_content_content_delivery_network