An information leak is the intentional or unintentional disclosure of information that either (1) is regarded as sensitive within the product's own functionality, such as a private message, or (2) provides information about the product or its environment that could be useful in an attack but is normally not available to the attacker, such as the installation path of a product that is remotely accessible. Many information leaks are resultant (e.g. path disclosure in PHP script error), but they can also be primary (e.g. timing discrepancies in crypto). There are many different types of problems that involve information leaks. Their severity can range widely depending on the type of information that is leaked. Compartmentalize your system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 1000 Category ChildOf 199 629 View ChildOf 629 635 View ChildOf 635 Information Leak (information disclosure) All 79 22 13 60 59 The software, when constructing file or directory names from input, does not properly sanitize special character sequences that resolve to a file or directory name that is outside of the intended directory or directories. Directory traversal "Path traversal" is preferred over "directory traversal." Like other Weaknesses, terminology is often based on the types of manipulations used, instead of the underlying Weaknesses. Some people use "directory traversal" only to refer to the injection of ".." and equivalent sequences whose specific meaning is to traverse directories. Other variants like "absolute pathname" and "drive letter" have the *effect* of directory traversal, but some people may not call it such, since it doesn't involve ".." or equivalent. File processing Primary (Weakness exists independent of other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) File/Directory Assume all input is malicious. Attackers can insert paths into input vectors and traverse the file system. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system. Warning: if you attempt to cleanse your data, then do so that the end result is not in the form that can be dangerous. A sanitizing mechanism can remove characters such as ‘.' and ‘;' which may be required for some exploits. An attacker can try to fool the sanitizing mechanism into "cleaning" data into a dangerous form. Suppose the attacker injects a ‘.' inside a filename (e.g. "sensi.tiveFile") and the sanitizing mechanism removes the character resulting in the valid filename, "sensitiveFile". If the input data are now assumed to be safe, then the file may be compromised. Pathname equivalence can be regarded as a type of canonicalization error. Some pathname equivalence issues are not directly related to directory traversal, rather are used to bypass security-relevant checks for whether a file/directory can be accessed by the attacker (e.g. a trailing "/" on a filename could bypass access rules that don't expect a trailing /, causing a server to provide the file when it normally would not). Incomplete diagnosis or reporting of vulnerabilities can make it difficult to know which variant is affected. For example, a researcher might say that "..\" is vulnerable, but not test "../" which may also be vulnerable. Any combination of the items below can provide its own variant, e.g. "//../" is not listed (CVE-2004-0325). Most of these issues are probably under-studied 1000 Weakness ChildOf 21 1000 Weakness ChildOf 610 629 View ChildOf 629 631 Category ChildOf 632 635 View ChildOf 635 Path Traversal All 76 23 The software does not perform access control checks in a consistent manner across all potential execution paths. For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any information that they are not authorized for by simply requesting direct access to that page. Ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page. For web applications, attackers can issue a request directly to a page (URL) that they may not be authorized to access. If the access control policy is not consistently enforced on every page restricted to authorized users, then an attacker could gain access to and possibly corrupt these resources. 1000 Weakness ChildOf 284 629 View ChildOf 629 Missing Access Control All 1 13 60 51 17 45 39 76 77 59 87 The software does not properly ensure that the user has proven their identity. An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries. Authentication Authentication bypass This can be resultant from SQL injection vulnerabilities and other issues. 1000 Category ChildOf 254 629 View ChildOf 629 635 View ChildOf 635 Authentication Error All 57 22 94 A product requires authentication, but the product has an alternate path or channel that does not require authentication. Note: this is often seen in web applications that assume that access to a particular CGI program can only be obtained through a "front" screen. But this problem is not just in web apps. Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource. CVE-2000-1179 CVE-1999-1454 CVE-2000-0944 CVE-1999-1077 CVE-2003-1035 overlaps brute force CVE-2003-0304 CVE-2002-0870 CVE-2004-0213 non-web CVE-2002-0066 Bypass authentication via direct request to named pipe. CVE-2003-1035 User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing. overlaps Unprotected Alternate Channel 1000 Weakness ChildOf 592 1000 Weakness PeerOf 420 629 View ChildOf 629 Authentication Bypass by Alternate Path/Channel All Architecture and Design 56 Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user. A mutual authentication protocol requires each party to respond to a random challenge by the other party by encrypting it with a pre-shared key. Often, however, such protocols employ the same pre-shared key for communication with a number of different entities. A malicious user or an attacker can easily compromise this protocol without possessing the correct key by employing a reflection attack on the protocol. Medium Authentication: The primary result of reflection attacks is successful authentication with a target machine -- as an impersonated user. Design: Use different keys for the initiator and responder or of a different type of challenge for the initiator and responder. Design: Let the initiator prove its identity before proceeding. C C++ Java Reflection attacks capitalize on mutual authentication schemes in order to trick the target into revealing the secret shared between it and another valid user. In a basic mutual-authentication scheme, a secret is known to both the valid user and the server; this allows them to authenticate. In order that they may verify this shared secret without sending it plainly over the wire, they utilize a Diffie-Hellman-style scheme in which they each pick a value, then request the hash of that value as keyed by the shared secret. In a reflection attack, the attacker claims to be a valid user and requests the hash of a random value from the server. When the server returns this value and requests its own value to be hashed, the attacker opens another connection to the server. This time, the hash requested by the attacker is the value which the server requested in the first connection. When the server returns this hashed value, it is used in the first connection, authenticating the attacker successfully as the impersonated valid user. 1000 Weakness ChildOf 287 1000 Weakness PeerOf 327 629 View ChildOf 629 Reflection attack in an auth protocol All 90 The failure to encrypt data passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys. Very High Confidentiality: Properly encrypted data channels ensure data confidentiality. Integrity: Properly encrypted data channels ensure data integrity. Accountability: Properly encrypted data channels ensure accountability. Requirements specification: require that encryption be integrated into the system. Design: Ensure that encryption is properly integrated into the system design, not simply as a drop-in replacement for sockets. C h_]]>h_length); if (a]]> Java If the application does not use a secure channel, such as SSL, to exchange sensitive information, it is possible for an attacker with access to the network traffic to sniff packets from the connection and uncover the data. This attack is not technically difficult, but does require physical access to some portion of the network over which the sensitive data travels. This access is usually somewhere near where the user is connected to the network (such as a colleague on the company network) but can be anywhere along the path from the user to the end server. Omitting the use of encryption in any program which transfers data over a network of any kind should be considered on par with delivering the data sent to each user on the local networks of both the sender and receiver. Worse, this omission allows for the injection of data into a stream of communication between two parties -- with no means for the victims to separate valid data from invalid. In this day of widespread network attacks and password collection sniffers, it is an unnecessary risk to omit encryption from the design of any system which might benefit from it. 1000 Category ChildOf 310 629 View ChildOf 629 Failure to encrypt data All 65 The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered High Authentication: If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. Design: Prevention schemes mirror that of hard-coded password storage. C C++ Java The main difference between the use of hard-coded passwords and the use of hard-coded cryptographic keys is the false sense of security that the former conveys. Many people believe that simply hashing a hard-coded password before storage will protect the information from malicious users. However, many hashes are reversible (or at least vulnerable to brute force attacks) -- and further, many authentication protocols simply request the hash itself, making it no better than a password. 1000 Category ChildOf 320 1000 Weakness ChildOf 344 1000 Weakness ChildOf 671 629 View ChildOf 629 Use of hard-coded cryptographic key All Cryptographic implementations should follow the algorithms that define them exactly otherwise encryption can be faulty. BID:2356 Overlaps incomplete/missing security check. Can be resultant. 1000 Category ChildOf 310 1000 Weakness ChildOf 573 1000 Weakness PeerOf 358 629 View ChildOf 629 Missing Required Cryptographic Step All 68 Insufficiently strong encryption schemes may not adequately secure secret data from attackers. Attackers can guess or use brute force attacks to break weakly encrypted schemes. Design: Use a cryptographic algorithm that is currently considered to be strong by experts in the field. CVE-2001-1546 Weak encryption CVE-2004-2172 Weak encryption (chosen plaintext attack) CVE-2002-1682 Weak encryption CVE-2002-1697 Weak encryption produces same ciphertext from the same plaintext blocks. CVE-2002-1739 Weak encryption CVE-2005-2281 Weak encryption scheme CVE-2002-1872 Weak encryption (XOR) CVE-2002-1910 Weak encryption (reversible algorithm). CVE-2002-1946 Weak encryption (one-to-one mapping). CVE-2002-1975 Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness). A variety of encryption algorithms exist, with various weaknesses. This category could probably be split into smaller sub-categories. 1000 Category ChildOf 310 1000 Weakness ChildOf 693 629 View ChildOf 629 Weak Encryption All Architecture and Design 20 The web application fails to adequately enforce appropriate authorization on all restricted URLs, scripts or files. Such web applications often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path. Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files. CVE-2004-2144 Bypass authentication via direct request. CVE-2005-1892 Infinite loop or infoleak triggered by direct requests. CVE-2004-2257 Bypass auth/auth via direct request. CVE-2005-1688 Direct request leads to infoleak by error. CVE-2005-1697 Direct request leads to infoleak by error. CVE-2005-1698 Direct request leads to infoleak by error. CVE-2005-1685 Authentication bypass via direct request. CVE-2005-1827 Authentication bypass via direct request. CVE-2005-1654 Authorization bypass using direct request. CVE-2005-1668 Access privileged functionality using direct request. CVE-2002-1798 Upload arbitrary files via direct request. Terminology Note: the "forced browsing" term could be misinterpreted to include weaknesses such as CSRF or XSS, so its use is discouraged. "Forced browsing" is a step-based manipulation involving the omission of one or more steps, whose order is assumed to be immutable; the application does not verify that the first step was performed. The consequence is typically "authentication bypass" or "path disclosure," although it can expose all kinds of weaknesses, especially in languages such as PHP, which allow external modification of assumed-immutable variables. overlaps Modification of Assumed-Immutable Data (MAID), authorization errors, container errors; often primary to other weaknesses such as XSS and SQL injection. 1000 Weakness ChildOf 288 1000 Weakness ChildOf 424 1000 Weakness CanAlsoBe 471 629 View ChildOf 629 Direct Request aka 'Forced Browsing All 87 The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. If a web product does not properly protect assumed-immutable values from modification in hidden form fields, parameters, cookies, or URLs, this can lead to modification of critical data. Web applications often mistakenly make the assumption that data passed to the client in hidden fields or cookies is not susceptible to tampering. Failure to validate portions of data that are user-controllable can lead to the application processing incorrect, and often malicious, input. Assumed-Immutable Parameter Tampering It is recommended not to pass hidden fields or cookies (apart from a session cookie) to the server. Furthermore, do not use parameters that are not from immediate user input. Assume all input is malicious. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system. CVE-2002-0108 Forum product allows spoofed messages of other users via hidden form fields for name and e-mail address. CVE-2000-0253 Shopping cart allows price modification via hidden form field. CVE-2000-0254 Shopping cart allows price modification via hidden form field. CVE-2000-0926 Shopping cart allows price modification via hidden form field. CVE-2000-0101 Shopping cart allows price modification via hidden form field. CVE-2000-0102 Shopping cart allows price modification via hidden form field. CVE-2000-0758 Allows admin access by modifying value of form field. CVE-2002-1880 Read messages by modifying message ID parameter. CVE-2000-1234 Send email to arbitrary users by modifying email parameter. CVE-2005-1652 Authentication bypass by setting a parameter. CVE-2005-1784 Product does not check authorization for configuration change admin script, leading to password theft via modified e-mail address field. CVE-2005-2314 Logic error leads to password disclosure. CVE-2005-1682 Modification of message number parameter allows attackers to read other people's messages. This is a primary weakness for many other weaknesses and functional consequences, including XSS, SQL injection, path disclosure, and file inclusion. For example, custom cookies commonly store session data or persistent data across sessions. This kind of session data is normally involved in security related decisions on the server side, such as user authentication and access control. Thus, the cookies might contain sensitive data such as user credentials and privileges. This is a dangerous practice, as it can often lead to improper reliance on the value of the client-provided cookie by the server side application. Without appropriate protection mechanisms, the client can easily tamper with cookies. Reliance on the cookies without detailed validation can lead to problems such as SQL injection. If you use cookie values for security related decisions on the server side, manipulating the cookies might lead to violations of security policies such as authentication bypassing, user impersonation and privilege escalation. In addition, storing sensitive data in the cookie without appropriate protection can also lead to disclosure of sensitive user data, especially data stored in persistent cookies. Hidden fields should not be trusted as secure parameters. An attacker can intercept and alter hidden fields in a post to the server as easily as user input fields. An attacker can simply parse the HTML for the substring < input type "hidden" or even just "hidden". Hidden field values displayed later in the session, such as on the following page, can open a site up to cross-site scripting attacks. This is a technology-specific MAID problem. 1000 Weakness ChildOf 471 629 View ChildOf 629 Web Parameter Tampering All 39 31 This weakness occurs when the application transmits or stores authentication credentials and uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Attackers are potentially able to bypass authentication mechanisms, hijack a victim's account, and obtain the role and respective access level of the accounts. 1000 Category ChildOf 255 629 View ChildOf 629 1000 Weakness ChildOf 668 50 The software fails to adequately filter command (control plane) syntax from user-controlled input (data plane) and then allows potentially injected commands to execute within its context. Very High Primary (Weakness exists independent of other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) Access control: Command injection allows for the execution of arbitrary commands and code by the attacker. Design: If at all possible, use library calls rather than external processes to recreate the desired functionality Implementation: Utilize black-list parsing to filter non-relevant command syntax from all input. Implementation: Ensure that all external commands called from the program are statically created, or -- if they must take input from a user -- that the input and final line generated are vigorously white-list checked. Run time: Run time policy enforcement may be used in a white-list fashion to prevent use of any non-sanctioned commands. Assign permissions to the software system that prevents the user from accessing/opening privileged files. The following simple program accepts a filename as a command line argument and displays the contents of the file back to the user. The program is installed setuid root because it is intended for use as a learning tool to allow system administrators in-training to inspect privileged system files without giving them the ability to modify them or damage the system. Because the program runs with root privileges, the call to system() also executes with root privileges. If a user specifies a standard filename, the call works as expected. However, if an attacker passes a string of the form ";rm -rf /", then the call to system() fails to execute cat due to a lack of arguments and then plows on to recursively delete the contents of the root partition. The following code is from an administrative web application designed allow users to kick off a backup of an Oracle database using a batch-file wrapper around the rman utility and then run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single command line parameter, which specifies what type of backup to perform. Because access to the database is restricted, the application runs the backup as a privileged user. The problem here is that the program does not do any validation on the backuptype parameter read from the user. Typically the Runtime.exec() function will not execute multiple commands, but in this case the program first runs the cmd.exe shell in order to run multiple commands with a single call to Runtime.exec(). Once the shell is invoked, it will happily execute multiple commands separated by two ampersands. If an attacker passes a string of the form "& del c:\\dbms\\*.*", then the application will execute this command along with the others specified by the program. Because of the nature of the application, it runs with the privileges necessary to interact with the database, which means whatever command the attacker injects will run with those privileges as well. The following code from a system utility uses the system property APPHOME to determine the directory in which it is installed and then executes an initialization script based on a relative path from the specified directory. The code above allows an attacker to execute arbitrary commands with the elevated privilege of the application by modifying the system property APPHOME to point to a different path containing a malicious version of INITCMD. Because the program does not validate the value read from the environment, if an attacker can control the value of the system property APPHOME, then they can fool the application into running malicious code and take control of the system. The following code is from a web application that allows users access to an interface through which they can update their password on the system. Part of the process for updating passwords in certain network environments is to run a make command in the /var/yp directory, the code for which is shown below. The problem here is that the program does not specify an absolute path for make and fails to clean its environment prior to executing the call to Runtime.exec(). If an attacker can modify the $PATH variable to point to a malicious binary called make and cause the program to be executed in their environment, then the malicious binary will be loaded instead of the one intended. Because of the nature of the application, it runs with the privileges necessary to perform system operations, which means the attacker's make will now be run with these privileges, possibly giving the attacker complete control of the system. The following code is a wrapper around the UNIX command cat which prints the contents of a file to standard out. It is also injectable: C #include int main(int a]]> Used normally, the output is simply the contents of the file requested: $ ./catWrapper Story.txt When last we left our heroes... However, if we add a semicolon and another command to the end of this line, the command is executed by catWrapper with no complaint: $ ./catWrapper Story.txt; ls When last we left our heroes... Story.txt doubFree.c nullpointer.c unstosig.c www* a.out* format.c strlen.c useFree* catWrapper* misnull.c strlength.c useFree.c commandinjection.c nodefault.c trunc.c writeWhatWhere.c If catWrapper had been set to have a higher privilege level than the standard user, arbitrary commands could be executed with that higher privilege. Command injection is a common problem with wrapper programs. Often, parts of the command to be run are controllable by the end user. If a malicious user injects a character (such as a semi-colon) that delimits the end of one command and the beginning of another, he may then be able to insert an entirely new and unrelated command to do whatever he pleases. The most effective way to deter such an attack is to ensure that the input provided by the user adheres to strict rules as to what characters are acceptable. As always, white-list style checking is far preferable to black-list style checking. Dynamically generating operating system commands that include user input as parameters can lead to command injection attacks. An attacker can insert operating system commands or modifiers in the user input that can cause the request to behave in an unsafe manner. Such vulnerabilities can be very dangerous and lead to data and system compromise. If no validation of the parameter to the exec command exists, an attacker can execute any command on the system the application has the privilege to access. Command injection vulnerabilities take two forms: * An attacker can change the command that the program executes: the attacker explicitly controls what the command is. * An attacker can change the environment in which the command executes: the attacker implicitly controls what the command means. In this case we are primarily concerned with the first scenario, in which an attacker explicitly controls the command that is executed. Command injection vulnerabilities of this type occur when: 1. Data enters the application from an untrusted source. 2. The data is part of a string that is executed as a command by the application. 3. By executing the command, the application gives an attacker a privilege or capability that the attacker would not otherwise have. G. Hoglund G. McGraw Exploiting Software: How to Break Code Addison-Wesley February 2004 1000 Weakness ChildOf 74 629 View ChildOf 629 Command Injection Command injection All 11 75 76 23 15 6 43 The software fails to adequately filter OS command syntax from user-controlled input and then allows potentially injected commands to execute within its context. A software system that accepts and executes input in the form of operating system commands (e.g. system(), exec(), open()) could allow an attacker with lesser privileges than the target software to execute commands with the elevated privileges of the executing process. The problem is exacerbated if the compromised process fails to follow the principle of least privilege. Shell injection, shell metacharacters Program invocation System Process Design: If at all possible, use library calls rather than external processes to recreate the desired functionality Implementation: Utilize black-list parsing to filter non-relevant OS command syntax from all input. Implementation: Ensure that all external commands called from the program are statically created, or -- if they must take input from a user -- that the input and final line generated are vigorously white-list checked. Run time: Run time policy enforcement may be used in a white-list fashion to prevent use of any non-sanctioned commands. Assign permissions to the software system that prevents the user from accessing/opening privileged files. CVE-1999-0067 CVE-2001-1246 CVE-2002-0061 CVE-2003-0041 CVE-2002-1898 Shell metacharacters in a telnet:// link (this is a multi-factor vulnerability, CVE-2007-3572 Chain: incomplete blacklist for OS command injection Fault: unquoted special characters, input restriction error G. Hoglund G. McGraw Exploiting Software: How to Break Code Addison-Wesley February 2004 1000 Weakness ChildOf 77 1000 Weakness CanAlsoBe 88 629 View ChildOf 629 630 View ChildOf 630 631 Category ChildOf 634 635 View ChildOf 635 OS Command Injection All 88 15 6 43 A weakness where the code path has: 1. start statement that accepts input 2. end statement that executes an operating system command where a. the input is used as a part of the operating system command b. the privilege of the operating system command is higher than privilege of the input and c. the operating system command is undesirable Where “undesirable” is defined through the following scenarios: 1. not validated 2. incorrectly validated The software does not sufficiently sanitize user-controllable input for content before it is prepared in output that is used as a web page. Unsanitized special elements that have control implications in web pages, such as HTML tags or mouse events, are interpreted as control characters that execute in violation of the client's trust in the application or system. This weakness usually enables cross-site scripting attacks in web applications. "CSS" was once used as the acronym for this problem, but this can cause confusion with the "Cascading Style Sheets," so this acronym has declined significantly. Its use is discouraged by CWE. High to Very High Resultant (Weakness is typically related to the presence of some other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) Confidentiality: The most common attack performed with cross-site scripting involves the disclosure of information stored in user cookies. Access control: In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws. If successful, cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Carefully check each input parameter against a rigorous positive specification (white list) defining the specific characters and format allowed. All input should be sanitized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. We often encounter data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended. This involves "HTML Entity Encoding" all non-alphanumeric characters from data that was received from the user and is now being written to the request. With Struts, you should write all data from form beans with the bean's filter attribute set to true. To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as Internet Explorer), this attribute prevents the user's session cookie from being accessed by client-side scripts, including scripts inserted due to a XSS attack. The following JSP code segment reads an employee ID, eid, from an HTTP request and displays it to the user. JSP ... Em]]>]]> The following ASP.NET code segment reads an employee ID number from an HTTP request and displays it to the user. ASP.NET The code in this example operates correctly if eid contains only standard alphanumeric text. If eid has a value that includes meta-characters or source code, then the code will be executed by the web browser as it displays the HTTP response. Initially this might not appear to be much of a vulnerability. After all, why would someone enter a URL that causes malicious code to run on their own computer? The real danger is that an attacker will create the malicious URL, then use e-mail or social engineering tricks to lure victims into visiting a link to the URL. When victims click the link, they unwittingly reflect the malicious content through the vulnerable web application back to their own computers. This mechanism of exploiting vulnerable web applications is known as Reflected XSS. The following JSP code segment queries a database for an employee with a given ID and prints the corresponding employee's name. JSP ]]>]]> The following ASP.NET code segment queries a database for an employee with a given employee ID and prints the name corresponding with the ID. ASP.NET This code functions correctly when the values of name are well-behaved, but it does nothing to prevent exploits if they are not. Again, this code can appear less dangerous because the value of name is read from a database, whose contents are apparently managed by the application. However, if the value of name originates from user-supplied data, then the database can be a conduit for malicious content. Without proper input validation on all data stored in the database, an attacker can execute malicious commands in the user's web browser. This type of exploit, known as Stored XSS, is particularly insidious because the indirection caused by the data store makes it more difficult to identify the threat and increases the possibility that the attack will affect multiple users. XSS got its start in this form with web sites that offered a "guestbook" to visitors. Attackers would include JavaScript in their guestbook entries, and all subsequent visitors to the guestbook page would execute the malicious code. As the examples demonstrate, XSS vulnerabilities are caused by code that includes unvalidated data in an HTTP response. There are three vectors by which an XSS attack can reach a victim: * As in the previous example, data is read directly from the HTTP request and reflected back in the HTTP response. Reflected XSS exploits occur when an attacker causes a user to supply dangerous content to a vulnerable web application, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces victims to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the user, the content is executed and proceeds to transfer private information, such as cookies that may include session information, from the user's machine to the attacker or perform other nefarious activities. * As in this example, the application stores dangerous data in a database or other trusted data store. The dangerous data is subsequently read back into the application and included in dynamic content. Stored XSS exploits occur when an attacker injects dangerous content into a data store that is later read and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. * A source outside the application stores dangerous data in a database or other data store, and the dangerous data is subsequently read back into the application as trusted data and included in dynamic content. CVE-2007-5727 Chain: only removes SCRIPT tags, enabling XSS CVE-2006-4308 Chain: only checks "javascript:" tag Cross-site scripting weakness occurs when dynamically generated web pages display input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Cross-site scripting (XSS) vulnerabilities occur when an attacker uses a web application to send malicious code, generally JavaScript, to a different end user. When a web application uses input from a user in the output it generates without filtering it, an attacker can insert an attack in that input and the web application sends the attack to other users. The end user trusts the web application, and the attacks exploit that trust to do things that would not normally be allowed. Attackers frequently use a variety of methods to encode the malicious portion of the tag, such as using Unicode, so the request looks less suspicious to the user. XSS attacks can generally be categorized into two categories: stored and reflected. Stored attacks are those where the injected code is permanently stored on the target servers in a database, message forum, visitor log, and so forth. Reflected attacks are those where the injected code takes another route to the victim, such as in an email message, or on some other server. When a user is tricked into clicking a link or submitting a form, the injected code travels to the vulnerable web server, which reflects the attack back to the user's browser. The browser then executes the code because it came from a 'trusted' server. For a reflected XSS attack to work, the victim must submit the attack to the server. This is still a very dangerous attack given the number of possible ways to trick a victim into submitting such a malicious request, including clicking a link on a malicious Web site, in an email, or in an inner-office posting. XSS flaws are very likely in web applications, as they require a great deal of developer discipline to avoid them in most applications. It is relatively easy for an attacker to find XSS vulnerabilities. Some of these vulnerabilities can be found using scanners, and some exist in older web application servers. The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. The most severe XSS attacks involve disclosure of the user's session cookie, which allows an attacker to hijack the user's session and take over their account. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, and modifying presentation of content. Cross-site scripting (XSS) vulnerabilities occur when: 1. Data enters a Web application through an untrusted source, most frequently a web request. 2. The data is included in dynamic content that is sent to a web user without being validated for malicious code. The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. Cross-site scripting attacks can occur wherever an untrusted user has the ability to publish content to a trusted web site. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity (such as sending all site cookies to a given E-mail address). If the input is unchecked, this script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also. There are several other possible attacks, such as running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy; cookie theft is however by far the most common. All of these attacks are easily prevented by ensuring that no script tags -- or for good measure, HTML tags at all -- are allowed in data to be posted publicly. Cross-site scripting attacks may occur anywhere that possibly malicious users are allowed to post unregulated material to a trusted web site for the consumption of other valid users. The most common example can be found in bulletin-board web sites which provide web based mailing list-style functionality. Jeremiah Grossman Robert "RSnake" Hansen Petko "pdp" D. Petkov Anton Rager Seth Fogie XSS Attacks Syngress 2007 M. Howard D. LeBlanc Writing Secure Code 2nd Edition Microsoft 2003 1000 Weakness ChildOf 74 1000 Weakness CanPrecede 494 1000 Compound_Element PeerOf 352 629 View ChildOf 629 635 View ChildOf 635 1000 692 Compound_Element CanPrecede 692 Cross-site scripting (XSS) Cross-site Scripting Cross-site scripting All 91 19 85 32 86 The application fails to adequately filter SQL syntax from user-controllable input. This can lead to such input being interpreted as SQL rather than ordinary user data and be executed as part of a dynamically generated SQL query. This is a specific form of an injection problem, one that explicitly affects SQL databases, in which SQL commands are injected into data-plane input in order to effect the execution of dynamically generated SQL statements. Very High Confidentiality: Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities. Authentication: If poor SQL commands are used to check user names and passwords, it may be possible to connect to a system as another user with no previous knowledge of the password. Authorization: If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability. Integrity: Just as it may be possible to read sensitive information, it is also possible to make changes or even delete this information with a SQL injection attack. Requirements specification: A non-SQL style database which is not subject to this flaw may be chosen. Design: Follow the principle of least privilege when creating user accounts to a SQL database. Users should only have the minimum privileges necessary to use their account. If the requirements of the system indicate that a user can read and modify their own data, then limit their privileges so they cannot read/write others' data. Design: Duplicate any filtering done on the client-side on the server side. Implementation: Implement SQL strings using prepared statements that bind variables. Prepared statements that do not bind variables can be vulnerable to attack. Implementation: Use vigorous white-list style checking on any user input that may be used in a SQL command. Rather than escape meta-characters, it is safest to disallow them entirely. Reason: Later use of data that have been entered in the database may neglect to escape meta-characters before use. Narrowly define the set of safe characters based on the expected value of the parameter in the request. The following code dynamically constructs and executes a SQL query that searches for items matching a specified name. The query restricts the items displayed to those where owner matches the user name of the currently-authenticated user. C# The query that this code intends to execute follows: SELECT * FROM items WHERE owner = <userName> AND itemname = <itemName>; However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string "name' OR 'a'='a" for itemName, then the query becomes the following: SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name' OR 'a'='a'; The addition of the OR 'a'='a' condition causes the where clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query: SELECT * FROM items; This simplification of the query allows the attacker to bypass the requirement that the query only return items owned by the authenticated user; the query now returns all entries stored in the items table, regardless of their specified owner. This example examines the effects of a different malicious value passed to the query constructed and executed in the above example. If an attacker with the user name hacker enters the string "hacker'); DELETE FROM items; --" for itemName, then the query becomes the following two queries: SQL Many database servers, including Microsoft(R) SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error on Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, on databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database. Notice the trailing pair of hyphens (--), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed [19]. In this case the comment character serves to remove the trailing single-quote left over from the modified query. On a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one shown in Example 1. If an attacker enters the string "name'); DELETE FROM items; SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name'; DELETE FROM items; SELECT * FROM items WHERE 'a'='a'; One traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from a whitelist of safe values or identify and escape a blacklist of potentially malicious values. Whitelisting can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, blacklisting is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers can: - Target fields that are not quoted - Find ways to bypass the need for certain escaped meta-characters - Use stored procedures to hide the injected meta-characters Manually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks. Another solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they fail to protect against many others. For example, the following PL/SQL procedure is vulnerable to the same SQL injection attack shown in the first example. procedure get_item ( itm_cv IN OUT ItmCurTyp, usr in varchar2, itm in varchar2) is open itm_cv for ' SELECT * FROM items WHERE ' || 'owner = '|| usr || ' AND itemname = ' || itm || '; end get_item; Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks. MS SQL has a built in function that enables shell command execution. An SQL injection in such a context could be disastrous. For example, a query of the form: Where $user_input is taken from the user and unfiltered. If the user provides the string: The query will take the following form: " Now, this query can be broken down into: [1] a first SQL query: SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='' [2] a second SQL query, which executes a shell command: exec master..xp_cmdshell 'vol' [3] an MS SQL comment: --' ORDER BY PRICE As can be seen, the malicious input changes the semantics of the query into a query, a shell command execution and a comment. CVE-2004-0366 CVE-2004-0343 CVE-2003-0779 CVE-2003-0500 CVE-2003-0377 SQL injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind. Essentially, the attack is accomplished by placing a meta character into data input to then place SQL commands in the control plane, which did not exist there before. This flaw depends on the fact that SQL makes no real distinction between the control and data planes. If successful, SQL Injection attacks can give an attacker access to backend database contents, the ability to remotely execute system commands, or in some circumstances the means to take control of the Windows server hosting the database. Dynamically generating queries that include user input can lead to SQL injection attacks. An attacker can insert SQL commands or modifiers in the user input that can cause the query to behave in an unsafe manner. Constructing a dynamic SQL statement with user input may allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands. Factors: resultant to special character mismanagement, MAID, or blacklist/whitelist problems. Can be primary to authentication errors. M. Howard D. LeBlanc Writing Secure Code 2nd Edition Microsoft 2003 1000 Weakness ChildOf 74 629 View ChildOf 629 630 View ChildOf 630 635 View ChildOf 635 SQL injection SQL Injection SQL injection All 66 7 A weakness where the code path has: 1. start statement that accepts input 2. end statement that performs an SQL command where a. the input is part of the SQL command and b. the SQL command is undesirable Where “undesirable” is defined through the following scenarios: 1. not validated 2. incorrectly validated The software does not sufficiently sanitize special elements that are used in LDAP queries or responses, allowing attackers to modify the syntax, contents, or commands of the LDAP query before it is executed. Assume all input is malicious. Use an appropriate combination of black lists and white lists to filter or quote LDAP syntax from user-controlled input. Factors: resultant to special character mismanagement, MAID, or blacklist/whitelist problems. Can be primary to authentication and verification errors. Under-reported. This is likely found very frequently by third party code auditors, but there are very few publicly reported examples. SPI Dynamics Web Applications and LDAP Injection 1000 Weakness ChildOf 74 629 View ChildOf 629 LDAP injection All The software does not properly filter or quote special characters or reserved words that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Assume all input is malicious. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system. In vulnerability theory terms, this is a representation-specific case of a Data/Directive Boundary Error. Under-reported. This is likely found regularly by third party code auditors, but there are very few publicly reported examples. Amit Klein Blind XPath Injection 2004-05-19 http://www.modsecurity.org/archive/amit/blind-xpath-injection.pdf 1000 Weakness ChildOf 74 629 View ChildOf 629 XML injection (aka Blind Xpath injection) All 83 The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not properly sanitize CRLF sequences from inputs. Primary (Weakness exists independent of other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) Avoid using CRLF as a special sequence. Appropriately filter or quote CRLF sequences in user-controlled input. CVE-2002-1771 CRLF injection enables spam proxy (add mail headers) using email address or name. CVE-2002-1783 CRLF injection in API function arguments modify headers for outgoing requests. CVE-2004-1513 Spoofed entries in web server log file via carriage returns CVE-2006-4624 Chain: inject fake log entries with fake timestamps using CRLF injection CVE-2005-1951 Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting. CVE-2004-1687 Chain: HTTP response splitting via CRLF in parameter related to URL. Factors: primary to HTTP Response Splitting. Probably under-studied, although gaining more prominence in 2005 as a result of interest in HTTP response splitting. Ulf Harnhammar CRLF Injection Bugtraq 2002-05-07 http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00079.html 1000 Weakness ChildOf 74 1000 Weakness CanPrecede 117 629 View ChildOf 629 CRLF Injection All 81 15 The software allows user-controlled input to be fed directly into a function (e.g. "eval") that dynamically evaluates and executes the input as code, usually in the same interpreted language that the product uses. Direct Dynamic Code Evaluation is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables. Direct code injection Medium Primary (Weakness exists independent of other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) Refactor your code so that it does not need to use eval() at all. Assume all input is malicious. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system. edit-config.pl: This CGI script is used to modify settings in a configuration file.