Reino: Input Validation and Representation

Problemas de validação e representação da entrada são causados por metacaracteres, codificações alternativas e representações numéricas. Confiar na entrada resulta em problemas de segurança. Os problemas incluem: “Buffer Overflows”, ataques de “Cross-Site Scripting”, “SQL Injection”, entre outros.

Dynamic Code Evaluation: Unsafe Deserialization

C#/VB.NET/ASP.NET
Java/JSP

Abstract

A desserialização de fluxos de objetos controlados pelo usuário em tempo de execução pode permitir que invasores executem código arbitrário no servidor, abusem da lógica do aplicativo e/ou levem à denial of service.

Explanation

A serialização. NET transforma os gráficos de objetos em fluxos de bites ou XML contendo os próprios objetos e os metadados necessários para reconstruí-los a partir do fluxo. Os desenvolvedores podem criar um código customizado para auxiliar no processo de desserialização de objetos. NET, onde eles podem substituir os objetos desserializados por objetos diferentes, ou proxies. O processo de desserialização customizado ocorre durante a reconstrução dos objetos, antes que os objetos sejam retornados ao aplicativo e convertidos nos tipos esperados. No momento em que os desenvolvedores tentam impor um tipo esperado, o código pode já ter sido executado.

A Serialização do .NET é usada em estruturas diferentes. Por exemplo:

1. Todas as versões do ASP.NET ignoram a configuração da propriedade EnableViewStateMac, pois ela introduz uma vulnerabilidade de execução remota de código no aplicativo. No entanto, o desenvolvedor pode substituir essa função pela configuração aspnet:AllowInsecureDeserialization e tornar o aplicativo vulnerável a uma execução remota de código.

Exemplo 1: No exemplo a seguir, aspnet:AllowInsecureDeserialization está definido como true.


  <appSettings>
    <add key="aspnet:AllowInsecureDeserialization" value="true" />
  </appSettings>

2. Os sistemas de comunicação remota .NET que dependem da validação do tipo de tempo de execução devem desserializar um fluxo remoto para começar a usá-lo, e um cliente não autorizado pode tentar explorar o momento da desserialização. A comunicação remota do .NET Framework fornece dois níveis de desserialização automática, Low e Full. Low, o valor padrão, protege contra ataques de desserialização por meio da desserialização apenas dos tipos associados à funcionalidade de comunicação remota mais básica, como desserialização automática de tipos de infraestrutura de comunicação remota, um conjunto limitado de tipos implementados pelo sistema e um conjunto básico de tipos personalizados. O nível de desserialização Full suporta a desserialização automática de todos os tipos que o sistema de comunicação remota suporta em todas as situações.

Exemplo 2: No exemplo a seguir, typeFilterLevel está definido como Full.


<system.runtime.remoting>
    <application>
      <channels>
        <channel ref="tcp" port="2000">
          <serverProviders>
            <formatter ref="soap" typeFilterLevel="Full" />
            <formatter ref="binary" typeFilterLevel="Full" />
          </serverProviders>
          <clientProviders>
            <formatter ref="binary"/>
          </clientProviders>
        </channel>
      </channels>
    </application>
    ...
</system.runtime.remoting>

References

[1] ASP.NET appSettings Element Microsoft

[2] Farewell, EnableViewStateMac Microsoft

[3] Standards Mapping - CIS Azure Kubernetes Service Benchmark 4

[4] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[5] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[6] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 4

[7] Standards Mapping - CIS Google Cloud Computing Platform Benchmark complete

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[9] Standards Mapping - CIS Kubernetes Benchmark complete

[10] Standards Mapping - Common Weakness Enumeration CWE ID 502

[11] Standards Mapping - Common Weakness Enumeration Top 25 2019 [23] CWE ID 502

[12] Standards Mapping - Common Weakness Enumeration Top 25 2020 [21] CWE ID 502

[13] Standards Mapping - Common Weakness Enumeration Top 25 2021 [13] CWE ID 502

[14] Standards Mapping - Common Weakness Enumeration Top 25 2022 [12] CWE ID 502

[15] Standards Mapping - Common Weakness Enumeration Top 25 2023 [15] CWE ID 502

[16] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001764, CCI-001774, CCI-002754

[17] Standards Mapping - FIPS200 SI

[18] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[19] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[20] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[21] Standards Mapping - OWASP Top 10 2004 A6 Injection Flaws

[22] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws

[23] Standards Mapping - OWASP Top 10 2010 A1 Injection

[24] Standards Mapping - OWASP Top 10 2013 A1 Injection

[25] Standards Mapping - OWASP Top 10 2017 A8 Insecure Deserialization

[26] Standards Mapping - OWASP Top 10 2021 A08 Software and Data Integrity Failures

[27] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.5.2 Input and Output Architectural Requirements (L2 L3), 5.5.1 Deserialization Prevention Requirements (L1 L2 L3), 5.5.3 Deserialization Prevention Requirements (L1 L2 L3)

[28] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection

[29] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[30] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[36] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[37] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[38] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[39] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[40] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[41] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation, Control Objective C.3.5 - Web Software Attack Mitigation

[42] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 116

[43] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3570 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3570 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3570 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3570 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3570 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3570 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3570 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[55] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[56] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[57] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[58] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[59] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[60] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[61] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[62] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[63] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[64] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.configuration.dotnet.dynamic_code_evaluation_unsafe_deserialization

Abstract

Explanation

A serialização Java transforma os gráficos de objetos em fluxos de bytes contendo os próprios objetos e os metadados necessários para reconstruí-los a partir do fluxo de bytes. Os desenvolvedores podem criar código customizado para auxiliar no processo de desserialização de objetos Java, onde eles podem até mesmo substituir os objetos desserializados por objetos diferentes, ou proxies. O processo de desserialização customizado ocorre durante a reconstrução dos objetos, antes que os objetos sejam retornados ao aplicativo e convertidos nos tipos esperados. No momento em que os desenvolvedores tentam impor um tipo esperado, o código pode já ter sido executado.

As rotinas de desserialização personalizadas são definidas nas classes serializáveis que precisam estar presentes no classpath do tempo de execução e não podem ser injetadas pelo invasor, portanto a capacidade de exploração desses ataques depende das classes disponíveis no ambiente do aplicativo. Infelizmente, classes comuns de terceiros ou mesmo classes JDK podem ser abusadas para exaurir os recursos da JVM, implantar arquivos mal-intencionados ou executar código arbitrário.

Alguns exportadores de serviços do Spring usam a serialização Java nos bastidores da camada de transporte (inclusive RMI, JMSInvoker e HTTPInvoker).

Exemplo 1: RMIServiceExporter expondo métodos TestService.


<bean id="testService" class="example.TestServiceImpl"/>
<bean class="org.springframework.remoting.rmi.RmiServiceExporter">
    <property name="serviceName" value="TestService"/>
    <property name="service" ref="testService"/>
    <property name="serviceInterface" value="example.TestService"/>
    <property name="registryPort" value="1199"/>
</bean>

Exemplo 2: JMSInvokerServiceExporter expondo métodos TestService.


<bean id="testService" class="example.TestServiceImpl"/>
<bean class="org.springframework.jms.remoting.JmsInvokerServiceExporter">
        <property name="serviceInterface" value="example.TestService"/>
        <property name="service" ref="testService"/>
</bean>

Exemplo 3: HTTPInvokerServiceExporter expondo métodos TestService.


<bean id="testService" class="example.TestServiceImpl"/>
<bean class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
        <property name="serviceInterface" value="example.TestService"/>
        <property name="service" ref="testService"/>
</bean>

References

[1] Fortify Application Defender

[2] Oracle Java Serialization

[3] IBM Look-ahead Java deserialization

[4] OWASP Deserialization of untrusted data

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 4

[6] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[7] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[8] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 4

[9] Standards Mapping - CIS Google Cloud Computing Platform Benchmark complete

[10] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[11] Standards Mapping - CIS Kubernetes Benchmark complete

[12] Standards Mapping - Common Weakness Enumeration CWE ID 502

[13] Standards Mapping - Common Weakness Enumeration Top 25 2019 [23] CWE ID 502

[14] Standards Mapping - Common Weakness Enumeration Top 25 2020 [21] CWE ID 502

[15] Standards Mapping - Common Weakness Enumeration Top 25 2021 [13] CWE ID 502

[16] Standards Mapping - Common Weakness Enumeration Top 25 2022 [12] CWE ID 502

[17] Standards Mapping - Common Weakness Enumeration Top 25 2023 [15] CWE ID 502

[18] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001764, CCI-001774, CCI-002754

[19] Standards Mapping - FIPS200 SI

[20] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[21] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[22] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[23] Standards Mapping - OWASP Top 10 2004 A6 Injection Flaws

[24] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws

[25] Standards Mapping - OWASP Top 10 2010 A1 Injection

[26] Standards Mapping - OWASP Top 10 2013 A1 Injection

[27] Standards Mapping - OWASP Top 10 2017 A8 Insecure Deserialization

[28] Standards Mapping - OWASP Top 10 2021 A08 Software and Data Integrity Failures

[29] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.5.2 Input and Output Architectural Requirements (L2 L3), 5.5.1 Deserialization Prevention Requirements (L1 L2 L3), 5.5.3 Deserialization Prevention Requirements (L1 L2 L3)

[30] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection

[31] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[32] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[36] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[37] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[38] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[39] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[40] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[41] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[42] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[43] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation, Control Objective C.3.5 - Web Software Attack Mitigation

[44] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 116

[45] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3570 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3570 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3570 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3570 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3570 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3570 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3570 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[55] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[56] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[57] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[58] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[59] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[60] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[61] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[62] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[63] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[64] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002560 CAT I

[65] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001480 CAT II, APSC-DV-001490 CAT II, APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[66] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.configuration.java.dynamic_code_evaluation_unsafe_deserialization