界: Input Validation and Representation

輸入驗證和表示法問題是由中繼字元、替代編碼和數值表示法引起的。信任輸入會導致安全問題。問題包括：「Buffer Overflows」、「Cross-Site Scripting」攻擊、「SQL Injection」及其他許多問題。

gRPC Metadata Manipulation

C#/VB.NET/ASP.NET
Java/JSP

Abstract

從不受信任的來源建立了 Google 遠端程序呼叫 (gRPC) Metadata 物件，這可能允許攻擊者控制關鍵通訊協定欄位。

Explanation

Metadata 類別通常用於存放 Google 遠端程序呼叫 (gRPC) 所用之基礎通訊協定的標頭資料。當基礎通訊協定是 HTTP 時，控制 Metadata 物件中的資料會使系統容易遭受 HTTP Header Manipulation 攻擊。其他攻擊途徑也是可能的，並且主要都是根據基礎通訊協定。

範例 1：以下程式碼顯示不可信賴的資料被當成 gRPC Metadata 物件的輸入使用。


    ...
    String? evnVar = System.Environment.GetEnvironmentVariable("evnVar ");
    Metadata headers = new Metadata();
    headers.Add("field", evnVar);
    CallOptions callOptions = new CallOptions(headers);
    ...

References

[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754

[2] Standards Mapping - FIPS200 SI

[3] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[6] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization

[7] Standards Mapping - OWASP Mobile 2014 M8 Security Decisions Via Untrusted Inputs

[8] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[9] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4, MASVS-PLATFORM-1

[10] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input

[11] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws

[12] Standards Mapping - OWASP Top 10 2010 A1 Injection

[13] Standards Mapping - OWASP Top 10 2013 A1 Injection

[14] Standards Mapping - OWASP Top 10 2017 A1 Injection

[15] Standards Mapping - OWASP Top 10 2021 A03 Injection

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.1

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[25] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[26] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[28] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I

[29] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I

[30] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I

[31] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I

[32] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

desc.dataflow.dotnet.grpc_metadata_manipulation

Abstract

從不受信任的來源建立了 Google 遠端程序呼叫 (gRPC) Metadata 物件，這可能允許攻擊者控制關鍵通訊協定欄位。

Explanation

Metadata 類別通常用於存放 Google 遠端程序呼叫 (gRPC) 所用之基礎通訊協定的標頭資料。當基礎通訊協定是 HTTP 時，控制 Metadata 物件中的資料會使系統容易遭受 HTTP Header Manipulation 攻擊。其他攻擊途徑也是可能的，並且主要都是根據基礎通訊協定。

範例 1：以下程式碼顯示使用者可控資料被當成 gRPC Metadata 物件的輸入使用。


...
String badData = getUserInput();
Metadata headers = new Metadata();
headers.put(Metadata.Key.of("sample", Metadata.ASCII_STRING_MARSHALLER), badData);
...