Reino: Input Validation and Representation

Problemas de validação e representação da entrada são causados por metacaracteres, codificações alternativas e representações numéricas. Confiar na entrada resulta em problemas de segurança. Os problemas incluem: “Buffer Overflows”, ataques de “Cross-Site Scripting”, “SQL Injection”, entre outros.

Denial of Service: Stack Exhaustion

Java/JSP

Abstract

Um invasor pode inserir dados especialmente criados para modificar ou definir a implementação da estrutura de dados de um programa, o que pode resultar em uma negação de serviço por meio do esgotamento da pilha.

Explanation

Dados especificados pelo usuário que são usados diretamente por um programa para modificar ou definir sua implementação de estrutura de dados podem ser suscetíveis ao esgotamento da pilha. Por exemplo, se um usuário pode criar links circulares em uma estrutura de dados vinculada que é processada recursivamente, isso poderá levar a uma recursão infinita que resulte no esgotamento da pilha.

Exemplo 1: O trecho de código a seguir demonstra essa vulnerabilidade usando o Apache Log4j2.


Marker child = MarkerManager.getMarker("child");
Marker parent = MarkerManager.getMarker("parent");

child.addParents(MarkerManager.getMarker(userInput));
parent.addParents(MarkerManager.getMarker(userInput2)); 
        
String toInfinity = child.toString();

Esse pequeno programa permite que o usuário defina o marcador pai de child e parent para um marcador definido pelo usuário. Se o usuário inserir o pai de child como parent e o pai de parent como child, um link circular será criado na estrutura de dados Marker. Ao executar o método recursivo toString na estrutura de dados que contém o link circular, o programa lançará uma exceção de estouro de pilha e travará. Isso causa uma negação de serviço por meio do esgotamento da pilha.

References

[1] DOS-1: Beware of activities that may use disproportionate resources Oracle

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 2

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 3

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[6] Standards Mapping - Common Weakness Enumeration CWE ID 730, CWE ID 674

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094

[8] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)

[9] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection

[10] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[11] Standards Mapping - OWASP API 2023 API4 Unrestricted Resource Consumption

[12] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation, Control Objective C.3.3 - Web Software Attack Mitigation

[21] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II, APSC-DV-002530 CAT II

[42] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[43] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.dataflow.java.denial_of_service_stack_exhaustion