Permission Manipulation: Logging

C#/VB.NET/ASP.NET

Abstract

允許使用者輸入直接修改判定稽核的權限，可能會讓攻擊者隱藏其活動。

Explanation

當攻擊者能夠修改應用程式中用於判定記錄內容的判定權限所使用的值時，就會出現權限操作記錄錯誤。在 Windows 中，存在系統存取控制清單 (SACL)，它們用於判定應該稽核的使用者和群組，進而查看存取資源是成功還是失敗。如果這些設定或存取設定中儲存的存取控制項目 (ACE) 可以由攻擊者控制，攻擊者有可能會停用其帳戶的稽核功能，如此一來，判定攻擊者可能在一個缺口中所執行的作業就變得更為艱難。

範例 1：以下程式碼可讓使用者指定要產生稽核記錄的作業。


...
CrytoKeyAuditRule auditRule = new CryptoKeyAuditRule(IdRef, (CryptoKeyRights) input, AuditFlags.Success); 
...

在此情況下，如果使用者可以控制 input，然後就能夠指定可以記錄的作業類型。如果使用者可以對 CryptoKeyRights.Delete 執行此作業，那麼他們可能會在不受記錄的情況下讀取加密金鑰，而您也覺察不到攻擊者已經竊取了您的加密金鑰。

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 264, CWE ID 732

[2] Standards Mapping - Common Weakness Enumeration Top 25 2019 [15] CWE ID 732

[3] Standards Mapping - Common Weakness Enumeration Top 25 2020 [16] CWE ID 732

[4] Standards Mapping - Common Weakness Enumeration Top 25 2021 [22] CWE ID 732

[5] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001813, CCI-002165

[6] Standards Mapping - FIPS200 AC

[7] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[8] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), AU-9 Protection of Audit Information (P1), CM-5 Access Restrictions for Change (P1)

[9] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, AU-9 Protection of Audit Information, CM-5 Access Restrictions for Change

[10] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization

[11] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.3.3 Other Access Control Considerations (L2 L3), 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3), 7.3.3 Log Protection Requirements (L2 L3)

[12] Standards Mapping - OWASP Mobile 2014 M8 Security Decisions Via Untrusted Inputs

[13] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[14] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[15] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[25] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[26] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[28] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 732

[29] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 732

[30] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 732

[31] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-001280 CAT II, APSC-DV-001290 CAT II, APSC-DV-001300 CAT II, APSC-DV-001310 CAT II, APSC-DV-001320 CAT II, APSC-DV-001330 CAT II, APSC-DV-001410 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-001280 CAT II, APSC-DV-001290 CAT II, APSC-DV-001300 CAT II, APSC-DV-001310 CAT II, APSC-DV-001320 CAT II, APSC-DV-001330 CAT II, APSC-DV-001410 CAT II

[46] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.dataflow.dotnet.permission_manipulation_logging