OWASP Web Security Guide

OWASPTOP10 2007RELEASECANDIDATE1

THETENMOSTCRITICALWEB APPLICATIONSECURITYVULNERABILITIES

2007UPDATE

©2002‐2007OWASPFoundation ThisdocumentislicensedundertheCreativeCommons Attribution‐ShareAlike2.5  Attribution‐ShareAlike2.5 license license

TableofCont ents ..................................... ........................................................ ...................................... ...................................... ...................................... ....................................... ....................................... .............................2 ..........2 Introduction .................................... ........................................................ ....................................... ...................................... ...................................... ...................................... ...................................... ...................................... ....................3 .3 Summary ...................................... ......................................................... ...................................... ....................................... ....................................... ...................................... ...................................... ...................................... .......................4 ....4 Methodology ...................................... ......................................................... ...................................... ...................................... ...................................... ...................................... ...................................... ....................................5 .................5 A1–CrossSiteScript A1–Cross SiteScript ing(XSS) .................................... ....................................................... ...................................... ...................................... ....................................... ....................................... .............................8 ..........8 A2–InjectionFlaws.................................. A2–Inje ctionFlaws..................................................... ...................................... ...................................... ...................................... ....................................... ....................................... .......................... ....... 11 A3–MaliciousF ileExecution ileExecut ion ..................................... ........................................................ ...................................... ...................................... ....................................... ....................................... .......................... ....... 13 A4–Insecur eDirectObjectRefer eDirectObj ectReference ence ...................................... ......................................................... ...................................... ...................................... ....................................... .............................. .......... 17 A5–CrossSiteRequ A5–Cross SiteRequestForg estForg ery(CSRF) ..................................... ........................................................ ...................................... ...................................... ....................................... .............................. .......... 19 A6–InformationLeakag A6–Infor mationLeakageandImp eandImproperEr roperErrorHand rorHandling ling ...................................... ......................................................... ...................................... ...................................... ..................... 22 A7–BrokenAuthenti A7–Broken AuthenticationandSe cationandSessionMana ssionMana gement ..................................... ........................................................ ...................................... ...................................... ....................... .... 24 A8–Insecur eCryptograp hicStorage............................ hicStorag e............................................... ....................................... ....................................... ...................................... ...................................... ....................... .... 26 A9–Insecur eCommunicat ions ..................................... ........................................................ ....................................... ....................................... ...................................... ...................................... ....................... .... 28 A10–FailuretoRestr A10–Failure toRestr ictURLAccess .................................... ....................................................... ...................................... ...................................... ...................................... .................................... ................. 30 WhereToGo FromHere FromH ere ....................................... .......................................................... ...................................... ...................................... ...................................... ...................................... ................................. .............. 32 References ...................................... .......................................................... ....................................... ...................................... ...................................... ...................................... ...................................... .................................... ................. 35

2

OWASP Top 10 2007

WelcometotheOWASPTop102 WelcometotheOWASPTop102007!This 007!Thistotallyre‐wr totallyre‐writtenediti itteneditionliststhemost onliststhemostseriouswebappli seriouswebapplication cation vulnerabilities, vulnerabilities,discusseshowto discusseshowtoprotectagai protectagainstthem,andprovi nstthem,andprovideslinksto deslinkstomoreinformation. moreinformation.

AIM

abouttheconsequencesofthemostc abouttheconsequencesofthemostcommonwebapplic ommonwebapplicationsecuri ationsecurityvulnerabil tyvulnerabilities.The ities.TheTop10 Top10 providesbasicmethodst providesbasicmethodstoprotectagains oprotectagainstthesevulnera tthesevulnerabilities– bilities–agreatstar agreatstarttoyoursecurecodi ttoyoursecurecodingsecurity ngsecurity program. .Itisinsufficient .Itisinsufficienttosecureyour tosecureyourcodejustonce.B codejustonce.By2008,thi y2008,thisTop10will sTop10will havechanged,andwithout havechanged,andwithoutchangingali changingalineofyoura neofyourapplication’s pplication’scode,youm code,youmaybevulnera aybevulnerable.Pleaserevi ble.Pleasereviewthe ewthe advicein Wheretogofromhere formoreinformation. formoreinformation. .Securewebapplications are

possiblewhenasecureSDLCi possiblewhenasecureSDLCisused.Secure sused.Secureprogramsaresecure programsaresecurebydesign,duri bydesign,duringdevelopmen ngdevelopment,andby t,andby

default.Thereareatle default.Thereareatleast300issues ast300issuesthataffectthe thataffecttheoverall overallsecurityofawe securityofawebapplic bapplication.These30 ation.These300+issuesare 0+issuesare detailedintheOWASPGuide detailedinthe OWASPGuide,whichisessentialrea ,whichisessentialreadingforanyone dingforanyonedevelopingwe developingwebapplications bapplicationstoday. today. .Pleasedonotadoptthis documentasapolicyorsta documentasapolicyorstandardwithout ndardwithouttalkingtous talkingtousfirst!Ify first!Ifyouneedasec ouneedasecurecodingpolic urecodingpolicyorstandard yorstandard,OWASP ,OWASP hassecurecodingpolici hassecurecodingpoliciesandstanda esandstandardsprojectsi rdsprojectsinprogress.Please nprogress.Pleaseconsiderjoini considerjoiningorfinanci ngorfinanciallyassis allyassistingwith tingwith theseefforts.

3

XSSflawsoccurwhenever XSSflawsoccurwheneveranapplic anapplicationtakesuser ationtakesusersupplieddataan supplieddataandsendsit dsendsit toawebbrowserwithoutfir toawebbrowserwithoutfirstvali stvalidatingorencodi datingorencodingthatcontent.X ngthatcontent.XSSallows SSallows attackerstoexecutescri attackerstoexecutescriptinthevic ptinthevictim’sbrowserwhi tim’sbrowserwhichcanhija chcanhijackuser ckuser sessions,defacewebsites sessions,defacewebsites,etc. ,etc. Injectionflaws,particularlySQLinjection,arecommoninwebapplications. Injectionoccurswhenuser Injectionoccurswhenuser‐supplieddat ‐supplieddataissenttoa aissenttoaninterpreteraspa ninterpreteraspartofa rtofa commandorquery.Theattac commandorquery.Theattacker’shostile ker’shostiledatatric datatrickstheinterpre kstheinterpreterinto terinto executingunintendedcom executingunintendedcommandsorchangi mandsorchangingdata. ngdata. Codevulnerabletoremote Codevulnerabletoremotefileincl fileinclusionallows usionallowsattackerstoi attackerstoincludehostile ncludehostile codeanddata,resul codeanddata,resultingindevas tingindevastatingattac tatingattacks,suchastotal ks,suchastotalserver server compromise. Adirectobjectreference Adirectobjectreferenceoccurswhenade occurswhenadeveloperexposesare veloperexposesareferenceto ferencetoan an internalimplementati internalimplementationobject,such onobject,suchasafile, asafile,directory, directory,databaserecord, databaserecord,or or key,asaURLorform key,asaURLorformparameter.Attack parameter.Attackerscanmani erscanmanipulatethosere pulatethosereferencesto ferencesto accessotherobjectswithout accessotherobjectswithoutauthoriza authorization. tion. ACSRFattackforcesal ACSRFattackforcesalogged‐onvictim ogged‐onvictim’sbrowsertose ’sbrowsertosendapre‐authenti ndapre‐authenticated cated requesttoavulnerablewe requesttoavulnerablewebapplic bapplication,whic ation,whichthenforcesthevic hthenforcesthevictim’sbrowser tim’sbrowser toperformahostileacti toperformahostileactiontothebenefitof ontothebenefitoftheattacker. theattacker. Applicationscanuni Applicationscanunintentionall ntentionallyleakin yleakinformationabout formationabouttheirconfigurati theirconfiguration, on, internalworkings,orvi internalworkings,orviolateprivac olateprivacythroughavari ythroughavarietyofapplic etyofapplicationproble ationproblems. ms. Attackersusethiswea Attackersusethisweaknesstoviola knesstoviolateprivacy, teprivacy,orconductfurther orconductfurtherattacks. attacks. Accountcredentialsa Accountcredentialsandsessiontokens ndsessiontokensareoftennotpr areoftennotproperlyprotecte operlyprotected. d. Attackerscompromisepas Attackerscompromisepasswords,keys,or swords,keys,orauthenticati authenticationtokenstoass ontokenstoassume ume otherusers’identities. Webapplicationsrarel Webapplicationsrarelyusecryptogr yusecryptographicfuncti aphicfunctionsproperlytoprotec onsproperlytoprotectdata tdata andcredentials.Atta andcredentials.Attackersuseweakl ckersuseweaklyprotecteddata yprotecteddatatoconduct toconductidentitythe identitytheft ft andothercrimes,suchas andothercrimes,suchascreditcar creditcardfraud. dfraud. Applicationsfreque Applicationsfrequentlyfail ntlyfailtoencryptnetwor toencryptnetworktrafficwhe ktrafficwhenitisnecessar nitisnecessaryto yto protectsensitivecomm protectsensitivecommunications. unications. Frequently,theonlypr Frequently,theonlyprotectionforsensi otectionforsensitivearea tiveareasofanapplic sofanapplicationisli ationislinksor nksor URLsarenotpresentedtouna URLsarenotpresentedtounauthorizedusers. uthorizedusers.Attackerscanus Attackerscanusethisweak ethisweakness ness toaccessandperformuna toaccessandperformunauthorizedoperati uthorizedoperations. ons.

4

OWASP Top 10 2007

OurmethodologyfortheTop10 OurmethodologyfortheTop102007wassimple 2007wassimple:takethe :taketheMITREVulner MITREVulnerabilityTre abilityTrendsfor2006 ndsfor2006,anddistilltheTop ,anddistilltheTop 10webapplicationsecurity issues.Therankedresultsa issues.Therankedresultsareasfollows reasfollows: :

Althoughwehavetried Althoughwehavetriedtopreservetheorder, topreservetheorder,wehavedeli wehavedeliberatelynotc beratelynotchosensomeweaknesse hosensomeweaknesses,suchasbuffe s,suchasbuffer r overflowsastheyarenotw overflowsastheyarenotwidelyappli idelyapplicabletoweb cabletowebapplication applicationsecurity. security.Inadditi Inaddition,wehavetrans on,wehavetransformedsome formedsome rawfindingsinto“meta”i rawfindingsinto“meta”issuestofull ssuestofullycapturetheroo ycapturetherootcauseofanis tcauseofanissuerepresented suerepresentedbythatdata. bythatdata. CrossSiteRequestForgery(CS CrossSiteRequestForgery(CSRF)isthemajor RF)isthemajornewadditiontot newadditiontothisediti hiseditionoftheOWASPTop1 onoftheOWASPTop10.Althoughraw 0.Althoughraw dataranksitat#36, dataranksitat#36,wefeelthat wefeelthatitisimporta itisimportantenoughthatappl ntenoughthatapplicationss icationsshouldstartprotec houldstartprotectioneffortst tioneffortstoday, oday, particularlyforhighvalueapplicationsandapplicationswhichdealwithsensitivedata. Wehavenotincludedl Wehavenotincludedlanguagespeci anguagespecific(C,C++ fic(C,C++,etc)issues, ,etc)issues,suchasbuffer suchasbufferoverflows,for overflows,formatstringatta matstringattacks,orany cks,orany oftheothercommonweaknesseswhic oftheothercommonweaknesseswhichplaguedesk hplaguedesktopandserversoftw topandserversoftware.Ifyouaredel are.Ifyouaredeliveringpr iveringprogramsfor ogramsfor desktoporserverplatforms,or desktoporserverplatforms,orareincludi areincludingtools,plug‐i ngtools,plug‐ins,orexternal ns,orexternalprogramstobec programstobecalledby alledbyyourweb yourweb application,westrongl application,westronglyrecommendyoure yrecommendyoureferencethe ferencetheOWASPGuide OWASPGuideandthebooksi andthebooksinthereferencessec nthereferencessectionfor tionfor moreinformationonhowto moreinformationonhowtobuildorusethese buildorusethesesafely. safely. Alloftheprotectionrec Alloftheprotectionrecommendationsprovi ommendationsprovidesolutionsforthe desolutionsforthethreemostprevale threemostprevalentwebapplic ntwebapplication ation frameworks:JavaEE,ASP.NET, frameworks:JavaEE,ASP.NET,andPHP.Othercomm andPHP.Othercommonwebapplic onwebapplicationframewor ationframeworks,suchasRuby ks,suchasRubyonRailsorPerl onRailsorPerl caneasilyadapttherec caneasilyadapttherecommendationstosui ommendationstosuittheirspecifi ttheirspecificneeds. cneeds.

BIASES Themethodologydescribeda Themethodologydescribedabovenecessaril bovenecessarilybiasestheTop10 ybiasestheTop10towardsdi towardsdiscoveriesby scoveriesbythesecurityrese thesecurityresearcher archer community.Thispatternof community.Thispatternofdiscoveryis discoveryissimilartothe similartothemethodsof methodsofactualattack,particularlyasitrelatestoentry‐ actualattack ,particularlyasitrelatestoentry‐ level("scriptkiddy") level("scriptkiddy")attackers.Pr attackers.Protectingyoursoft otectingyoursoftwareagain wareagainsttheTop10wi sttheTop10willprovi llprovideamodicumo deamodicumofprotection fprotection againstthemostcommonforms againstthemostcommonformsofattack, ofattack,butfarmoreimportant butfarmoreimportantly,help ly,helpsetacoursefor setacourseforimprovingt improvingthesecurityof hesecurityof yoursoftware.

5

MAPPING Therehavebeenchanges Therehavebeenchangestotheheadings,e totheheadings,evenwhereconte venwherecontentmapsclosel ntmapscloselytopreviousc ytopreviouscontent.Wenol ontent.Wenolongeruse ongeruse theWASXMLnamingscheme theWASXMLnamingschemeasithasnotk asithasnotkeptuptodatew eptuptodatewithmodernvulner ithmodernvulnerabili abilities,attacks, ties,attacks,and and countermeasures.Thetablebel countermeasures.Thetablebelowdepictshowthi owdepictshowthiseditionmapst seditionmapstotheTop10200 otheTop102004,andther 4,andtherawMITREranking: awMITREranking:

WHYWEHAVEDROPPEDSOMEIMPORTANTISSUES isamajorchallengefor isamajorchallengeforanydevelopment anydevelopmentteam,andis team,andisattherootofma attherootofmanyapplic nyapplication ation securityproblems.Infac securityproblems.Infact,manyofthe t,manyoftheotheritemsinthe otheritemsinthelistrec listrecommendvalidati ommendvalidatinginputasa nginputasapartofthesol partofthesolution. ution. Westillstronglyrecom Westillstronglyrecommendcreati mendcreatingacentralize ngacentralizedinputvali dinputvalidationmecha dationmechanismasapart nismasapartofyourweb ofyourwebapplicati applications. ons. Formoreinformation,rea Formoreinformation,readthefollowing dthefollowingdatavali datavalidationarticl dationarticlesatOWASP: esatOWASP: 

http://www.owasp.org/index. http://www.owa sp.org/index.php/Data_Vali php/Data_Validation dation



http://www.owasp.org/index. http://www.owa sp.org/index.php/Testing_for_Dat php/Testing_for_Data_Validati a_Validation on areextremelyseriousvul areextremelyseriousvulnerabilitie nerabilitiesfor sfor

programswritteninlanguag programswritteninlanguagessuchasC essuchasCorC++.Remediati orC++.Remediationfortheseiss onfortheseissuesiscovered uesiscoveredbythetradi bythetraditionalnon‐ tionalnon‐ webapplicationsecuri webapplicationsecuritycommunity, tycommunity,suchasSANS,C suchasSANS,CERT,andprogramming ERT,andprogramminglanguage languagetoolvendors.Ify toolvendors.Ifyourcodeis ourcodeis

6

OWASP Top 10 2007 writteninalanguagetha writteninalanguagethatislike tislikelytosuffer lytosufferbufferoverflows, bufferoverflows,weencourageyou weencourageyoutoreadthebuffe toreadthebufferoverflow roverflow contentonOWASP: 

http://www.owasp.org/index. http://www.owa sp.org/index.php/Buffer_overfl php/Buffer_overflow ow



http://www.owasp.org/index. http://www.owa sp.org/index.php/Testing_for_Buffe php/Testing_for_Buffer_Overflow r_Overflow isaseriousattackthatc isaseriousattackthatcanaffect anaffectanysitewri anysitewritteninanyla tteninanylanguage.Thera nguage.TherankingofDoS nkingofDoSby by

MITREisinsufficientto MITREisinsufficienttomaketheTop1 maketheTop10thisyear.I 0thisyear.Ifyouhaveconce fyouhaveconcernsaboutdeni rnsaboutdenialofservice alofservice,youshouldc ,youshouldconsult onsult theOWASPsiteandTestingGuide: 

http://www.owasp.org/index. http://www.owa sp.org/index.php/Category:De php/Category:Denial_of_Servic nial_of_Service_Attack e_Attack



http://www.owasp.org/index. http://www.owa sp.org/index.php/Testing_for_De php/Testing_for_Denial_of_Servi nial_of_Service ce affectsallsystemstosomee affectsallsystemstosomeextent,partic xtent,particularlyPHP. ularlyPHP.However,the However,the

rankingbyMITREdoesnotal rankingbyMITREdoesnotallowustoincl lowustoincludethisissue udethisissuethisyear.W thisyear.Whendeployingyour hendeployingyourapplicati application,youshould on,youshould consultthelatestOWASPGui consultthelatestOWASPGuideandtheOWASP deandtheOWASPTestingGuide TestingGuidefordetaile fordetailedinformationreg dinformationregardingsecure ardingsecure configurationmanagement configurationmanagementandtesting andtesting: : 

http://www.owasp.org/index. http://www.owa sp.org/index.php/Configurati php/Configuration on



http://www.owasp.org/index. http://www.owa sp.org/index.php/Testing_for_i php/Testing_for_infrastructure_c nfrastructure_configuration_mana onfiguration_management gement

VULNERABILITIES,NOTATTACKS Thepreviouseditionof ThepreviouseditionoftheTop10contai theTop10containedamixture nedamixtureofattacks,vul ofattacks,vulnerabilitie nerabilitiesandcounterme sandcountermeasures.Thistime asures.Thistime around,wehavefocuseds around,wehavefocusedsolelyonvul olelyonvulnerabilitie nerabilities.Iforganizati s.Iforganizationsusethis onsusethisdocumenttosecurethei documenttosecuretheirapplic rapplications, ations, andreducetheriskstot andreducetheriskstotheirbusiness,i heirbusiness,itwillle twillleadtoadirec adtoadirectreductionin treductioninthelikeli thelikelihoodof: hoodof: 

Phishingattacksthatca Phishingattacksthatcanexploita nexploitanyofthesevul nyofthesevulnerabilities, nerabilities,particul particularlyXSS,an arlyXSS,andweakornon‐exi dweakornon‐existent stent authenticationorauthorizationchecks(A1,A4,A7,A10)



Privacyviolationsfrompoorvalidation,businessruleandweakauthorizationchecks(A2,A4,A6,A7,A10)



Identitytheftthroughpoororn Identitytheftthroughpoorornon‐existentcry on‐existentcryptographiccontrol ptographiccontrols(A8andA9) s(A8andA9),remotefile ,remotefileinclude(A include(A3) 3) andauthentication,busi andauthentication,businessrule,andauthor nessrule,andauthorizationc izationchecks(A4,A7 hecks(A4,A7,A10) ,A10)



Systemscompromisethroughremote Systemscompromisethroughremotefileincl fileinclude(A3)andendof ude(A3)andendofbusinesscl businessclassofdata assofdataalteration alterationor or destructionattacksviaInjections(A2)



Financiallossthr Financiallossthroughunauthorized oughunauthorizedtransactions transactionsandCSRFattacks( andCSRFattacks(A4,A5,A7 A4,A5,A7,A10) ,A10)



Reputationlossthroughexploi Reputationlossthroughexploitationofany tationofanyoftheabovevul oftheabovevulnerabili nerabilities(A1… ties(A1…A10) A10)

Onceanorganization Onceanorganizationmovesawayfromw movesawayfromworryingaboutreacti orryingaboutreactivecontrols, vecontrols,andmovesforwar andmovesforwardtoproactivel dtoproactively y reducingrisksapplic reducingrisksapplicabletothei abletotheirbusiness,t rbusiness,theywillim heywillimprovecompli provecompliancewithreg ancewithregulatoryregimes, ulatoryregimes,reduce reduce operationalcosts,and operationalcosts,andhopefullywil hopefullywillhavefarmore lhavefarmorerobustandsecure robustandsecuresystemsasare systemsasaresult. sult.

ACKNOWLEDGEMENTS WethanktheMITREProjectformakingVulnerabilityTypeDistributioninCVE  VulnerabilityTypeDistributioninCVE data freelyavailable freelyavailableforuse.TheOW foruse.TheOWASPTopTenprojecti ASPTopTenprojectisledandsponsore sledandsponsoredby dbyAspect Aspect Security. Security .

7

Crosssitescripting, Crosssitescripting,betterknownasXS betterknownasXSS,isthemostpre S,isthemostprevalentandper valentandperniciouswe niciouswebapplicat bapplicationsecurit ionsecurityissue.XSS yissue.XSS flawsoccurwheneveranappl flawsoccurwheneveranapplicati icationtakesdatatha ontakesdatathatoriginated toriginatedfromauserandse fromauserandsendsittoaweb ndsittoawebbrowserwithout browserwithout firstvalidatingorencodingthatcontent. XSSallowsattackerstoe XSSallowsattackerstoexecutescript xecutescriptinthevicti inthevictim’sbrowser,whi m’sbrowser,whichcanhija chcanhijackusersessions ckusersessions,defacewe ,defacewebsites, bsites, inserthostilecontent,c inserthostilecontent,conductphishing onductphishingattacks, attacks,andtakeoverthe andtakeovertheuser’sbrowserusi user’sbrowserusingscriptingma ngscriptingmalware.The lware.The maliciousscripti maliciousscriptisusuallyJ susuallyJavaScript avaScriptbutanyscri butanyscriptinglanguages ptinglanguagesupportedbythevi upportedbythevictim’sbrowser ctim’sbrowserisapotenti isapotential al targetforthisattack.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletocrosssitescri tocrosssitescripting. pting.

VULNERABILITY Therearethreeknowntypes Therearethreeknowntypesofcrosssitescri ofcrosssitescripting:reflec pting:reflected,stored,andD ted,stored,andDOMinjection. OMinjection.ReflectedX ReflectedXSSisthe SSisthe easiesttoexploit–apa easiesttoexploit–apagewillre gewillreflectusersuppli flectusersupplieddatadirec eddatadirectlybacktot tlybacktotheuser: heuser: echo $_REQUEST['userinput'];

StoredXSStakeshostiledat StoredXSStakeshostiledata,storesiti a,storesitinafile,a nafile,adatabase,orot database,orotherbackends herbackendsystem,andthen ystem,andthenatalaterstage atalaterstage, , displaysthedatatot displaysthedatatotheuser,unfil heuser,unfiltered.Thisise tered.Thisisextremelydangerous xtremelydangerousinsystemssuc insystemssuchasCMS,blogs, hasCMS,blogs,orforums, orforums, wherealargenumberofusers wherealargenumberofuserswillseei willseeinputfromotheri nputfromotherindividual ndividuals. s. WithDOMbasedXSSattac WithDOMbasedXSSattacks,thesite’s ks,thesite’sJavaScript JavaScriptcodeandvaria codeandvariablesaremani blesaremanipulatedrather pulatedratherthanHTMLele thanHTMLelements. ments. Alternatively,attac Alternatively,attackscanbeablen kscanbeablendorhybridof dorhybridofallthreetype allthreetypes.Thedangerwi s.Thedangerwithcrosssite thcrosssitescriptingi scriptingisnotthetype snotthetype ofattack,butthatiti ofattack,butthatitispossible. spossible. AttacksareusuallyimplementedinJavaScript,whichisapowerfulscriptinglanguage.UsingJavaScriptallows attackerstomanipulate attackerstomanipulateanyaspec anyaspectoftherenderedpag toftherenderedpage,including e,includingaddingnewel addingnewelements(suc ements(suchasaddingalogi hasaddingalogin n tilewhichforwardscr tilewhichforwardscredentialsto edentialstoahostilesit ahostilesite),manip e),manipulatingany ulatinganyaspectoftheint aspectoftheinternalDOMtree ernalDOMtree,anddeleti ,anddeletingor ngor changingthewaythe changingthewaythepagelooksandfeel pagelooksandfeels.JavaScri s.JavaScriptallowsthe ptallowstheuseofXmlHttpRe useofXmlHttpRequest,whichis quest,whichistypicall typicallyusedby yusedby sitesusingAJAXtechnol sitesusingAJAXtechnologies,eveni ogies,evenifvictimsi fvictimsitedoesnotuseAJAX tedoesnotuseAJAXtoday. today. UsingXmlHttpRequest,i UsingXmlHttpRequest,itissometimes tissometimespossibletogeta possibletogetaroundabrowser’s roundabrowser’ssamesourceorigi samesourceoriginationpolic nationpolicy‐thus y‐thus forwardingvictimda forwardingvictimdatatohostile tatohostilesites,andtoc sites,andtocreatecomplexw reatecomplexwormsandmalic ormsandmaliciouszombiestha iouszombiesthatlastasl tlastaslongasthe ongasthe browserstaysopen.AJAXatta browserstaysopen.AJAXattacksdonotha cksdonothavetobevisibl vetobevisibleorrequire eorrequireuserinterac userinteractiontoperform tiontoperformdangerouscross dangerouscross siterequestforgery(CSR siterequestforgery(CSRF)attacks(see F)attacks(seeA‐5). A‐5).

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythatallthe thatalltheparametersin parametersintheapplic theapplicationarevali ationarevalidatedand/ore datedand/orencodedbeforebei ncodedbeforebeingincluded ngincluded inHTMLpages.

8

OWASP Top 10 2007 Automatedapproaches:Both Automatedapproaches:Bothvulnerabili vulnerabilityscanningtool tyscanningtoolsandstaticcode sandstaticcodeanalysis analysistoolscanfi toolscanfindsimpleX ndsimpleXSS SS problems,particularl problems,particularlyreflected yreflectedones.Theyfrequentl ones.Theyfrequentlycan'tfin ycan'tfindcomplexXSS dcomplexXSSflaws,suc flaws,suchaswhenthei haswhentheinjection njection occursinapeculia occursinapeculiarHTMLstructure rHTMLstructureorscript.They orscript.Theyarealsonotli arealsonotlikelytofindi kelytofindinstancesofDOMba nstancesofDOMbasedXSS. sedXSS. Manualapproaches:If Manualapproaches:Ifacentralize acentralizedvalidati dvalidationandencodi onandencodingmechanismisuse ngmechanismisused,themosteffi d,themostefficientwayto cientwaytoverify verify securityistocheckthe securityistocheckthecode.Ifadi code.Ifadistributedi stributedimplementationi mplementationisused,thenthe sused,thentheverificati verificationwillbec onwillbeconsiderably onsiderably moretime‐consuming.Testi moretime‐consuming.Testingistime‐c ngistime‐consumingbecause onsumingbecausetheattacksurface theattacksurfaceofmostappli ofmostapplicationsi cationsissolarge. ssolarge.

PROTECTION ThebestprotectionforXSSis ThebestprotectionforXSSisacombinati acombinationof"whitelis onof"whitelist"validati t"validationofallinc onofallincomingdataa omingdataandappropriatee ndappropriateencoding ncoding ofalloutputdata.Val ofalloutputdata.Validationall idationallowsthedetecti owsthedetectionofattac onofattacks,andencodingpre ks,andencodingpreventsanys ventsanysuccessfulscri uccessfulscriptinjection ptinjection fromrunninginthebrowser. PreventingXSSacrossanenti PreventingXSSacrossanentireapplica reapplicationrequire tionrequiresaconsistenta saconsistentarchitectural rchitecturalapproach: approach: 

Useastandardinputvalidationmechanismtovalidateallinputdataforlength,type, syntax,andbusinessrulesbe syntax,andbusinessrulesbeforeaccepti foreacceptingthedatato ngthedatatobedisplayedors bedisplayedorstored.Usean"a tored.Usean"acceptknown cceptknown good"validationstrateg good"validationstrategy.Rejectinv y.Rejectinvalidinputra alidinputratherthanatte therthanattemptingtosani mptingtosanitizepotenti tizepotentiallyhostile allyhostiledata. data.



Ensurethatalluser‐suppli Ensurethatalluser‐supplieddatai eddataisHTMLentit sHTMLentityencodedbeforere yencodedbeforerendering ndering inHTML,takingthea inHTML,takingtheapproachtoencode pproachtoencodeallcharac allcharactersotherthana tersotherthanaverylimi verylimitedsubset.Thisi tedsubset.Thisisthe sthe approachoftheMicrosoftA approachoftheMicrosoftAnti‐XSSlibr nti‐XSSlibrary,andthe ary,andtheforthcomingOWASPP forthcomingOWASPPHPAnti‐XSSli HPAnti‐XSSlibrary. brary.



todetectXSSininputortoencod todetectXSSininputortoencodeoutput.Searc eoutput.Searchingforand hingforand replacingjustafewc replacingjustafewcharacters("<"" haracters("<"">"andother >"andothersimilarchara similarcharacters)iswe cters)isweakandhasbeen akandhasbeenattacked attacked successfully.

Languagespecific Languagespecificrecommendations: recommendations: 

Java:UseStrutsoutputmechan Java:UseStrutsoutputmechanismssucha ismssuchas s,orusethede ,orusethedefaultJSTLesc faultJSTLescapeXML="true" apeXML="true" attributein.D attributein.DoNOTuse<%=…%>unne oNOTuse<%=…%>unnested(thatis, sted(thatis,outsideofaproper outsideofaproperlyencode lyencodedoutput doutput mechanism).



.NET:UsetheMicrosoftAnti .NET:UsetheMicrosoftAnti‐XSSLibrary ‐XSSLibrary1.5freely 1.5freelyavailable availablefromMSDN.Do fromMSDN.Donotassignform notassignformfieldsdata fieldsdata username.Text = Request.QueryString("username");withoutusing directlyfromtheRequestobject:username.Text

thislibrary.Understa thislibrary.Understandwhich.NETc ndwhich.NETcontrolsautomatic ontrolsautomaticallyencodeo allyencodeoutputdata. utputdata. 

htmlentities ()orhtmlspecialchars ()orusethesoontobe PHP:Ensureoutputispassedthroughhtmlentities

releasedOWASPPHPAnti‐XSSli releasedOWASPPHPAnti‐XSSlibrary. brary.

SAMPLES 

http://cve.mitre.org/cgi‐bin/cvename.cgi?name=CVE‐2006‐4206 



http://cve.mitre.org/cgi‐bin/cvename.cgi?name=CVE‐2005‐3966 



http://cve.mitre.org/cgi‐bin/cvename.cgi?name=CVE‐2006‐5204 

REFERENCES 

OWASP–Crosssitescripting,http://www.owasp.org/index.php/Cr http://www.owasp.org/index.php/Cross_Site_Scri oss_Site_Scripting pting



OWASP–TestingforXSS,http://www.owasp.org/index.php/Testi http://www.owasp.org/index.php/Testing_for_Cross_site_s ng_for_Cross_site_scripting cripting

9



OWASPStingerProject(AJava OWASPStingerProject(AJavaEEvalida EEvalidationfil tionfilter)– ter)– http://www.owasp.org/index. http://www.owa sp.org/index.php/Category:OWASP_ php/Category:OWASP_Stinger_Project Stinger_Project



OWASPPHPFilterProject‐http://www.owasp.org/index.php/OWASP_PHP_Filters http://www.owasp.org/index.php/OWASP_PHP_Filters



OWASPEncodingProject‐http://www.owasp.org/index.php/Cate http://www.owasp.org/index.php/Category:OWASP_Encodi gory:OWASP_Encoding_Project ng_Project



RSnake,XSSCheatSheet,http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html



Klein,A.,DOMBasedCr Klein,A.,DOMBasedCrossSiteScri ossSiteScripting, pting,http://www.we http://www.webappsec.org/projec bappsec.org/projects/article ts/articles/071105.sht s/071105.shtml ml



.NETAnti‐XSSLibrary‐ http://www.micr http://www.microsoft.com/downloads/de osoft.com/downloads/details.aspx? tails.aspx?FamilyID=e FamilyID=efb9c819‐53ff‐4 fb9c819‐53ff‐4f82‐ f82‐ bfaf‐e11625130c25&DisplayLang=en 

10

OWASP Top 10 2007

Injectionflaws,part Injectionflaws,particularly icularlySQLinjecti SQLinjection,arecommoninw on,arecommoninwebapplic ebapplications.Injec ations.Injectionoccursw tionoccurswhenuser‐supplie henuser‐supplied d dataissenttoaninterpre dataissenttoaninterpreteraspartof teraspartofacommandorquery. acommandorquery.Theattacker’s Theattacker’sdatatricks datatrickstheinterpreter theinterpreterinto into executingunintendedcomm executingunintendedcommands.Injecti ands.Injectionflawsallow onflawsallowattackerstocre attackerstocreate,read,upda ate,read,update,ordelete te,ordeleteanyarbitrar anyarbitrary y dataavailableto dataavailabletotheapplic theapplication.Inthew ation.Intheworstcasescenari orstcasescenario,theseflaws o,theseflawsallowa allowanattackertocom nattackertocompletely pletely compromisetheapplication.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksthat onframeworksthatuseinterpreters useinterpretersarevulnerabl arevulnerabletoinjecti etoinjectionattacks. onattacks.

VULNERABILITY Ifuserinputispassedi Ifuserinputispassedintoaninterpreter ntoaninterpreterwithoutvali withoutvalidationorenc dationorencoding,theappli oding,theapplicationis cationisvulnerable. vulnerable.Checkif Checkif userinputissuppliedt userinputissuppliedtodynamicqueri odynamicqueries,sucha es,suchas: s: $sql = "SELECT * FROM table WHERE id = '" . $_REQUEST['id’] . "’";

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythatuserdatac thatuserdatacannotmodifythe annotmodifythemeaningofc meaningofcommandsandqueri ommandsandqueriessenttoanyof essenttoanyofthe the interpretersinvokedbytheapplication. Automatedapproaches:Many Automatedapproaches:Manyvulnerabili vulnerabilityscanning tyscanningtoolssearchfor toolssearchforinjection injectionproblems,partic problems,particularlySQL ularlySQLinjection. injection. Detectingwhethertheinjec Detectingwhethertheinjectionworkedornot tionworkedornotisdiffic isdifficultandpronetoe ultandpronetoerror.Statica rror.Staticanalysistool nalysistoolsthatsearch sthatsearchfor for usesofunsafeinterpreterAPI usesofunsafeinterpreterAPIsareuseful, sareuseful,butfrequentl butfrequentlycannotverify ycannotverifythatappropri thatappropriatevalida atevalidationorencodi tionorencoding ng mightbeinplacetoprotectagainstthevulnerability. Manualapproaches:Themo Manualapproaches:Themostefficie stefficientandaccura ntandaccurateapproachist teapproachistocheckthec ocheckthecodethatinvokesi odethatinvokesinterpreters.The nterpreters.The reviewershouldveri reviewershouldverifytheuseofas fytheuseofasafeAPIorthatapp afeAPIorthatappropriateval ropriatevalidationand/ idationand/orencodingha orencodinghasoccurred.Te soccurred.Testing sting canbeextremelytime‐co canbeextremelytime‐consumingandspotty nsumingandspottybecausethe becausetheattacksurface attacksurfaceofmostapplic ofmostapplicationsiss ationsissolarge. olarge.

PROTECTION Avoidtheuseofinterprete Avoidtheuseofinterpreterswhenpossible rswhenpossible.Ifyoumusti .Ifyoumustinvokeaninterpre nvokeaninterpreter,thekeyme ter,thekeymethodtoavoidi thodtoavoidinjections njections istheuseofsafeAPIs,s istheuseofsafeAPIs,suchasstronglyt uchasstronglytypedparameteri ypedparameterizedqueries zedqueriesandobjectrela andobjectrelationalmap tionalmapping(ORM)li ping(ORM)libraries. braries. Theseinterfaceshandle Theseinterfaceshandlealldataes alldataescaping,ordo caping,ordonotrequireesca notrequireescaping.Notetha ping.Notethatwhilesa twhilesafeinterfacesso feinterfacessolvethe lvethe problem,validationi problem,validationisstillrec sstillrecommendedinorder ommendedinordertodetectattac todetectattacks. ks. Usinginterpretersis Usinginterpretersisdangerous,soit'sw dangerous,soit'sworthittotakee orthittotakeextracare,s xtracare,suchasthefoll uchasthefollowing: owing:    

whenconnectingtodatabas whenconnectingtodatabasesandotherbac esandotherbackendsystems kendsystems thatareusefultoanattacker intoaparameterizedinterface astheycanbeinjectable

11



(suchasmysql_query()orsimilar)



,suchasPHP’saddslashes() ,suchasPHP’saddslashes()orcharacterre orcharacterreplacement placement functionslikestr_repl functionslikestr_replace("’"," ace("’","’’").Thesearew ’’").Theseareweakandhave eakandhavebeensuccessfull beensuccessfullyexploitedby yexploitedbyattackers. attackers.

Languagespecific Languagespecificrecommendations: recommendations: 

JavaEE–usestronglytyped JavaEE–usestronglytypedPreparedStateme PreparedStatement,orORMssuchas nt,orORMssuchasHibernateorSpri HibernateorSpring ng



.NET–usestronglytypedpara .NET–usestronglytypedparameterizedquerie meterizedqueries,suchasSqlC s,suchasSqlCommandwithSql ommandwithSqlParameteroran ParameteroranORMlike ORMlike Hibernate.



PHP–usePDOwithstronglytype PHP–usePDOwithstronglytypedparameterized dparameterizedqueries(usingbi queries(usingbindParam()) ndParam())

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐5121 ‐2006‐5121 



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐4953 ‐2006‐4953 



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐4592 ‐2006‐4592

REFERENCES 

OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/SQL_ /index.php/SQL_Injection Injection



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/G /index.php/Guide_to_SQL_Injec uide_to_SQL_Injection tion



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Re /index.php/Reviewing_Code_for_ viewing_Code_for_SQL_Injecti SQL_Injection on



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Tes /index.php/Testing_for_SQL_In ting_for_SQL_Injection jection



SQLInjection,http://www.spidy SQLInjection,http://www.spidynamics.c namics.com/papers/SQLInject om/papers/SQLInjectionWhitePaper ionWhitePaper.pdf  .pdf 



AdvancedSQLInjection, http://www.ngssoftwa http://www.ngssoftware.com/papers/ re.com/papers/advanced_s advanced_sql_injection. ql_injection.pdf pdf 



MoreAdvancedSQLInjection,http://www.nextgenss.com/paper http://www.nextgenss.com/papers/more_advance s/more_advanced_sql_injec d_sql_injection.pdf tion.pdf



Hibernate,anadvance Hibernate,anadvancedobjectrelati dobjectrelationalmanager(O onalmanager(ORM)forJ2EEand.N RM)forJ2EEand.NET, ET,http://www.hibernate.org/ http://www.hibernate.org/



J2EEPreparedStatements,http://java.sun.com/docs/books/tutori http://java.sun.com/docs/books/tutorial/jdbc/basi al/jdbc/basics/prepared. cs/prepared.html html



Howto:ProtectfromSQLinjec Howto:ProtectfromSQLinjectioninASP.Net, tioninASP.Net, http://msdn2.microsoft.com http://msdn2. microsoft.com/en‐us/librar /en‐us/library/ms998271.a y/ms998271.aspx spx



12

PHPPDOfunctions,http://php.net/pdo http://php.net/pdo

OWASP Top 10 2007

Maliciousfileexecutionvulnerabilitiesarefoundinmanyapplications.Developerswilloftendirectlyuseor concatenatepotentiall concatenatepotentiallyhostilei yhostileinputwithfile nputwithfileorstreamfunc orstreamfunctions,orimpr tions,orimproperlytrusti operlytrustinputfiles.O nputfiles.Onmany nmany platforms,frameworksall platforms,frameworksallowtheuseofexterna owtheuseofexternalobjectre lobjectreferences,such ferences,suchasURLsorfil asURLsorfilesystemrefere esystemreferences.When nces.When thedataisinsuffici thedataisinsufficientlychec entlychecked,thiscan ked,thiscanleadtoarbitr leadtoarbitraryremoteand aryremoteandhostilecontent hostilecontentbeingincl beingincluded,processed uded,processed orinvokedbythewebserver. Thisallowsattackers Thisallowsattackerstoperform: toperform: 

Remotecodeexecution



Remoterootkitinstall Remoterootkitinstallationandcomple ationandcompletesystemcompromise tesystemcompromise



OnWindows,internalsystem OnWindows,internalsystemcompromisemay compromisemaybepossiblethroug bepossiblethroughtheuseofPHP’sS htheuseofPHP’sSMBfilewrap MBfilewrappers pers

Thisattackispartic Thisattackisparticularlypreva ularlyprevalentonPHP,a lentonPHP,andextremecarem ndextremecaremustbetakenwi ustbetakenwithanystreamorfil thanystreamorfilefunctio efunctionto nto ensurethatusersuppliedi ensurethatusersuppliedinputdoesnotinfl nputdoesnotinfluencefilena uencefilenames. mes.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksthat onframeworksthatallowuploade allowuploadedfilestobee dfilestobeexecutedarevul xecutedarevulnerabletorem nerabletoremotefileincl otefileinclude.By ude.By default,PHP4.0.4andl default,PHP4.0.4andlaterand5.xare aterand5.xarevulnerable vulnerabletoremotefilei toremotefileinclusion.O nclusion.Otherenvironments therenvironmentsaresuscepti aresusceptibleif bleif theyallowfileuploadintowebdirectories.

VULNERABILITY Acommonvulnerableconstr Acommonvulnerableconstructis: uctis: include $_REQUEST['filename’];

Notonlydoesthisall Notonlydoesthisallowevaluation owevaluationofremotehostile ofremotehostilescripts,i scripts,itcanbeusedto tcanbeusedtoaccessloc accesslocalfileserv alfileservers(ifPHPis ers(ifPHPis hosteduponWindows)duetoSMB hosteduponWindows)duetoSMBsupportinPHP’sfi supportinPHP’sfilesystemwrapper lesystemwrappers. s. Othermethodsofattackinclude: 

Hostiledatabeingupl Hostiledatabeinguploadedtosessionfil oadedtosessionfiles,logdata es,logdata,andviai ,andviaimageuploads( mageuploads(typicalof typicalofforumsoftware) forumsoftware)



Usingcompressionoraudi Usingcompressionoraudiostreams,such ostreams,suchaszlib:// aszlib://orogg://whic orogg://whichdonotinspectthe hdonotinspecttheinternalPHPUR internalPHPURL L flagandthusallowac flagandthusallowaccesstoremoteresou cesstoremoteresourceseveni rcesevenifallow_url fallow_url_fopenorall _fopenorallow_url_incl ow_url_includeisdisable udeisdisabled d



UsingPHPwrappers,suchas UsingPHPwrappers,suchasphp://inputand php://inputandotherstotakeinpu otherstotakeinputfromtherequest tfromtherequestPOSTdatarather POSTdataratherthan than afile



data:;base64,PD9waHAgcGhwaW5mbygpOz8+ UsingPHP’sdata:wrapper,suchasdata:;base64,PD9waHAgcGhwaW5mbygpOz8+

Asthislistisextensi Asthislistisextensive(andperiodic ve(andperiodicallychange allychanges),itis s),itisvitaltouse vitaltouseaproperly aproperlydesignedsecuri designedsecurityarchitec tyarchitectureand tureand robustdesignwhendealing robustdesignwhendealingwithusersuppl withusersuppliedinputsi iedinputsinfluenci nfluencingthechoice ngthechoiceofserverside ofserversidefilenamesan filenamesandaccess. daccess.

13

AlthoughPHPexampleshavebeeng AlthoughPHPexampleshavebeengiven,thisa iven,thisattackisal ttackisalsoapplic soapplicableindiffere ableindifferentwaysto.N ntwaysto.NETandJ2EE. ETandJ2EE. Applicationswritte Applicationswritteninthoseframewor ninthoseframeworksneedtopayp ksneedtopayparticular articularattentiontoc attentiontocodeaccesssec odeaccesssecuritymechanism uritymechanismsto sto ensurethatfilenamessuppl ensurethatfilenamessuppliedbyorin iedbyorinfluencedby fluencedbytheuserdonotall theuserdonotallowsecurityc owsecuritycontrolstobeobvi ontrolstobeobviated. ated. Forexample,itispossi Forexample,itispossiblethatXML blethatXMLdocumentssubmit documentssubmittedbyanattac tedbyanattackerwill kerwillhaveahostile haveahostileDTDthatforce DTDthatforcesthe sthe XMLparsertoloadaremote XMLparsertoloadaremoteDTD,andparse DTD,andparseandprocessther andprocesstheresults.AnAustra esults.AnAustraliansec liansecurityfirmha urityfirmhasdemonstrated sdemonstrated thisapproachtoportsc thisapproachtoportscanningbehindfi anningbehindfirewalls.See rewalls.See[SIF01]inthis [SIF01]inthischapter’srefere chapter’sreferencesformorei ncesformoreinformation. nformation. Thedamagethisparticul Thedamagethisparticularvulnerabi arvulnerabilitycause litycausesisdirectl sisdirectlyrelatedto yrelatedtothestrengthofthes thestrengthofthesandbox/platfor andbox/platform m isolationcontrolsi isolationcontrolsintheframework.A ntheframework.AsPHPisrarel sPHPisrarelyisolatedandha yisolatedandhasnosandboxc snosandboxconceptorsecuri onceptorsecurityarchitec tyarchitecture, ture, thedamageisfarworse thedamageisfarworseforanattack foranattackthanotherplat thanotherplatformswithli formswithlimitedorparti mitedorpartialtrust,orare altrust,orarecontainedwi containedwithina thina suitablesandbox,suchas suitablesandbox,suchaswhenaweba whenawebappisrunning ppisrunningunderaJVMwith underaJVMwiththesecurity thesecuritymanagerproperl managerproperlyenabledand yenabledand configured(whichi configured(whichisrarelythe srarelythedefault). default).

VERIFYINGSECURITY Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscanningtool canningtoolswillhave swillhavediffic difficultyidenti ultyidentifyingthepara fyingtheparametersthatareus metersthatareusedin edin afileincludeort afileincludeorthesyntaxforma hesyntaxformakingthemwork.S kingthemwork.Staticanal taticanalysistoolsc ysistoolscansearchfor ansearchfortheuseofdanger theuseofdangerousAPIs, ousAPIs, butcannotverifytha butcannotverifythatappropriateva tappropriatevalidation lidationorencodingmightbe orencodingmightbeinplace inplacetoprotectagai toprotectagainstthevulner nstthevulnerability. ability. Manualapproaches:Acode Manualapproaches:Acodereviewcan reviewcansearchforcodeth searchforcodethatmightall atmightallowafile owafiletobeincludedi tobeincludedintheappli ntheapplication,but cation,but therearemanypossiblemi therearemanypossiblemistakestorec stakestorecognize.Testingc ognize.Testingcanalsodetec analsodetectthesevulnera tthesevulnerabilities, bilities,butidentifyi butidentifyingthe ngthe particularparametersandtherightsyntaxcanbedifficult.

PROTECTION Preventingremotefileincl Preventingremotefileincludeflaws udeflawstakessomecarefu takessomecarefulplanning lplanningatthearchi atthearchitecturaland tecturalanddesignphases, designphases,throughto throughto thoroughtesting.Ingeneral thoroughtesting.Ingeneral,awell‐wr ,awell‐writtenapplic ittenapplicationwill ationwillnotuseuser‐suppli notuseuser‐suppliedinputi edinputinanyfile nanyfilenameforany nameforany server‐basedresource(such server‐basedresource(suchasimages,XML asimages,XMLandXSLtr andXSLtransformdocuments,or ansformdocuments,orscriptinc scriptinclusions),andw lusions),andwillhave illhave firewallrulesin firewallrulesinplaceprevent placepreventingnewoutbound ingnewoutboundconnectionsto connectionstotheInternetori theInternetorinternally nternallybacktoanyother backtoanyotherserver. server. However,manylegacy However,manylegacyapplicati applicationswillco onswillcontinuetohavea ntinuetohaveaneedtoaccep needtoacceptusersuppliedi tusersuppliedinput. nput. Amongthemostimportantconsi Amongthemostimportantconsiderationsare derationsare: : 

Consideravariable Consideravariablenamingschemeto namingschemetoassistwithta assistwithtaintchecki intchecking: ng:

$hostile = &$_POST; // refer to POST variables, not $_REQUEST $safe[‘filename’]= validate_file_name($hostile[‘unsafe_filename’]); // make it safe

Thereforeanyoperationbase Thereforeanyoperationbaseduponhostilei duponhostileinputisimmedia nputisimmediately telyobvious: obvious: 

require_once($_POST[‘unsafe_filename’] . ‘inc.php’);



require_once($safe[‘filename’] . ‘inc.php’);



Stronglyvalidateuseri Stronglyvalidateuserinputusing"acc nputusing"acceptknowngood"a eptknowngood"asastrategy sastrategy



Hideserver‐sidefile Hideserver‐sidefilenamesfromtheuser. namesfromtheuser.Forexample,ins Forexample,insteadofinclud teadofincluding$lang ing$language.".lang.php" uage.".lang.php",use ,use anarrayindexlikethis:

14

OWASP Top 10 2007 Français … $language = intval($_POST['language’]); if ($language > 0) { require_once($lang[$language]); // lang is array of strings eg "fr.lang.php" } 

Disableallow_url_fopenandallow_url_includeinphp.iniandconsiderbuildingPHPlocallytonotinclude thisfunctionality.



Addfirewallrulesto Addfirewallrulestopreventwebserve preventwebserversmakingnewc rsmakingnewconnectionstoexterna onnectionstoexternalwebsitesa lwebsitesandinternal ndinternal systems.Forhighvaluesys systems.Forhighvaluesystems,isola tems,isolatethewebserveri tethewebserverinitsownVLAN nitsownVLANorprivates orprivatesubnet. ubnet.



Ensurethatfileandstrea Ensurethatfileandstreamsfunctions(s msfunctions(stream_*)arec tream_*)arecarefully arefullyvetted.Ensuretha vetted.Ensurethattheuserinputi ttheuserinputisnot snot suppliedanyfunctionwhichtakesafilenameargument,including:

include() include_once() require() require_once() fopen() imagecreatefromXXX() file() file_get_contents() copy() delete() unlink() upload_tmp_dir() $_FILES move_uploaded_file() 

Beextremelycautiousif Beextremelycautiousifdataispasse dataispassedtosystem()eval() dtosystem()eval()passthru()or passthru()or`(thebackti `(thebacktickoperator). ckoperator).



Checkthatanyfiles Checkthatanyfilestakenfromthe takenfromtheuserforlegiti userforlegitimatepurposesc matepurposescannotbeotherwise annotbeotherwiseobviated,s obviated,suchas uchas includingusersupplie includingusersupplieddatainthe ddatainthesessionobjec sessionobject,avatarsandi t,avatarsandimages,PDFrep mages,PDFreports,temporaryfile orts,temporaryfiles,and s,and soon.



WithPHP,considerimplemen WithPHP,considerimplementingachr tingachrootjailorother ootjailorothersandboxmechanis sandboxmechanismssuchasvirt mssuchasvirtualizati ualizationto onto isolateapplicati isolateapplicationsfromeachother onsfromeachother



WithJ2EE,ensurethatthesec WithJ2EE,ensurethatthesecuritymanageri uritymanagerisenabledandpr senabledandproperlyconfig operlyconfiguredandthat uredandthattheapplicat theapplication ion isdemandingpermissionsa isdemandingpermissionsappropriatel ppropriately y



WithASP.NET,pleaserefert WithASP.NET,pleaserefertothedocumenta othedocumentationonpartial tiononpartialtrust,andde trust,anddesignyourappl signyourapplicationst icationstobe obe segmentedintrust,sothatmos segmentedintrust,sothatmostoftheapplic toftheapplicationexistsi ationexistsinthelowestpossi nthelowestpossibletruststatep bletruststatepossible ossible

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2007‐0360 ‐2007‐0360



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐5220 ‐2006‐5220 



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐4722 ‐2006‐4722

REFERENCES 

OWASPGuide,http://www.owas OWASPGuide,http://www.owasp.org/index.php/Fi p.org/index.php/File_System#Incl le_System#Includes_and_Remote_fi udes_and_Remote_files les



OWASPTestingGuide,http://www.owasp.org/index.php/Tes http://www.owasp.org/index.php/Testing_for_Direc ting_for_Directory_Traversal tory_Traversal



OWASPPHPTop5,http://www.ow OWASPPHPTop5,http://www.owasp.org/index.php/P asp.org/index.php/PHP_Top_5#P1:_Remote_Cod HP_Top_5#P1:_Remote_Code_Execution e_Execution

15



StefanEsser, http://blog.php‐security. http://blog. php‐security.org/archive org/archives/45‐PHP‐5.2.0‐an s/45‐PHP‐5.2.0‐and‐allow_url d‐allow_url_include. _include.html html



[SIF01]SiftNetworks,We [SIF01]SiftNetworks,WebServices:Teac bServices:Teachinganolddog hinganolddognewtricks, newtricks, http://www.ruxcon.org.au/fil http://www.r uxcon.org.au/files/2006/web_ser es/2006/web_services_securi vices_security.ppt ty.ppt



http://www.owasp.org/index. http://www.owa sp.org/index.php/OWASP_Java_Ta php/OWASP_Java_Table_of_Contents# ble_of_Contents#Defining_a_ Defining_a_Java_Securi Java_Security_Policy ty_Policy



Microsoft‐ProgrammingforP Microsoft‐ProgrammingforPartialTrust, artialTrust,http://msdn2.microsoft.com/en‐ http://msdn2.microsoft.com/en‐ us/library/ms364059(VS.80).aspx 

16

OWASP Top 10 2007

Adirectobjectreference Adirectobjectreferenceoccurswhen occurswhenadeveloperexposes adeveloperexposesareference areferencetoaninternal toaninternalimplementat implementationobject,suc ionobject,such h asafile,director asafile,directory,databaserec y,databaserecord,orkey, ord,orkey,asaURLor asaURLorformparameter.Unle formparameter.Unlessanacce ssanaccesscontrolchec sscontrolcheckisinpla kisinplace, ce, anattackercanmani anattackercanmanipulatethoserefer pulatethosereferencestoacce encestoaccessotherobjectswi ssotherobjectswithoutauthoriz thoutauthorization. ation.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletoattacksonin toattacksoninsecuredirec securedirectobjectreferences tobjectreferences. .

VULNERABILITY Manyapplicationsexpose Manyapplicationsexposetheirinterna theirinternalobjectrefere lobjectreferencestousers.Att ncestousers.Attackersusepar ackersuseparametertamperingtoc ametertamperingtochange hange referencesandviolate referencesandviolatetheintendedbut theintendedbutunenforcedacc unenforcedaccesscontrol esscontrolpolicy.Frequentl policy.Frequently,thesereferenc y,thesereferencespointtofi espointtofile le systemsanddatabases,but systemsanddatabases,butanyexposedapplic anyexposedapplicationcons ationconstructcouldbe tructcouldbevulnerable. vulnerable. Forexample,ifcodeal Forexample,ifcodeallowsuseri lowsuserinputtospecifyfi nputtospecifyfilenamesorpa lenamesorpaths,itmay ths,itmayallowattac allowattackerstojumpoutof kerstojumpoutofthe the application’sdirec application’sdirectory,andacces tory,andaccessotherresource sotherresources. s. Français … require_once ($_REQUEST['language’]."lang.php");

Suchcodecanbeattacked Suchcodecanbeattackedusingastri usingastringlike"../. nglike"../../../../etc/ ./../../etc/passwd%00"usi passwd%00"using ngnullbyteinjection nullbyteinjection (seetheOWASP (seetheOWASP Guideformoreinfor Guide formoreinformation)toacce mation)toaccessanyfile ssanyfileonthewebserver’ onthewebserver’sfilesystem sfilesystem. . Similarly,reference Simil arly,referencestodatabasekey stodatabasekeysarefrequen sarefrequentlyexposed.Anat tlyexposed.Anattackercana tackercanattackthesepar ttacktheseparameterssimply ameterssimplyby by guessingorsearchingfor guessingorsearchingforanothervalid anothervalidkey.Often,these key.Often,thesearesequenti aresequentialinnature. alinnature.Intheexample Intheexamplebelow,eve below,evenifan nifan applicationdoesnotprese applicationdoesnotpresentanyli ntanylinkstounauthorize nkstounauthorizedcarts,andno dcarts,andnoSQLinjection SQLinjectionispossible, ispossible,anattacker anattackercanstill canstill changethecartIDparameter changethecartIDparametertowhateverc towhatevercarttheywant. arttheywant. int cartID = Integer.parseInt( request.getParameter( "cartID" ) ); String query = "SELECT * FROM table WHERE cartID=" + cartID;

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythattheapplic thattheapplicationdoesnot ationdoesnotallowdirectobj allowdirectobjectreference ectreferencestobemanipul stobemanipulatedbyanattac atedbyanattacker. ker. Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscanningtool canningtoolswillhave swillhavediffic difficultyidenti ultyidentifyingwhic fyingwhichparametersare hparametersare susceptibletomanipul susceptibletomanipulationorwhether ationorwhetherthemanipula themanipulationworked. tionworked.Staticanal Staticanalysistoolsrea ysistoolsreallycannot llycannotknowwhich knowwhich parametersmusthaveanac parametersmusthaveanaccesscontrolc cesscontrolcheckbeforeu heckbeforeuse. se. Manualapproaches:Codere Manualapproaches:Codereviewcan viewcantracecritic tracecriticalparameters alparametersandidentify andidentifywhetherthey whethertheyaresusceptible aresusceptibleto to manipulationinmanyc manipulationinmanycases.Penetratio ases.Penetrationtestingcan ntestingcanalsoverify alsoverifythatmanipul thatmanipulationispossi ationispossible.However,bot ble.However,bothof hof thesetechniquesaretime thesetechniquesaretime‐consumingandc ‐consumingandcanbespotty. anbespotty.

17

PROTECTION Thebestprotectionistoavoi Thebestprotectionistoavoidexposingdirec dexposingdirectobjectreferenc tobjectreferencestousersbyus estousersbyusinganindex, inganindex,map,orotheri map,orotherindirect ndirect methodthatiseasytova methodthatiseasytovalidate.If lidate.Ifadirectobjec adirectobjectreferencemustbe treferencemustbeused,ensuretha used,ensurethattheuseris ttheuserisauthorizedbefore authorizedbefore usingit. Establishingastandar Establishingastandardwayofreferri dwayofreferringtoappli ngtoapplicationobjects cationobjectsisimporta isimportant: nt: 

Avoidexposingyourprivate Avoidexposingyourprivateobjectreferenc objectreferencestouserswhenever estouserswheneverpossible possible



Validateanyprivate Validateanyprivateobjectrefere objectreferencesextensivel ncesextensivelywithan"ac ywithan"acceptknowngood"a ceptknowngood"approach pproach



Verifyauthorization Verifyauthorizationtoallreferenc toallreferencedobjects edobjects

Ifyoumustexposeafile Ifyoumustexposeafilesystemreference systemreference,useanindex ,useanindexvalueorama valueoramaptopreventpa ptopreventpathandfilena thandfilename me manipulation. http://www.example.com/application?file=1

Ifyoumustexposedirectrefer Ifyoumustexposedirectreferencestodataba encestodatabasestructures,e sestructures,ensurethatSQL nsurethatSQLstatementsandother statementsandotherdatabase database accessmethodsonlyall accessmethodsonlyallowauthorizedre owauthorizedrecordstobeshown: cordstobeshown: int cartID = Integer.parseInt( request.getParameter( "cartID" ) ); User user = (User)request.getSession().getAttribute( "user" ); String query = "SELECT * FROM table WHERE cartID=" + cartID + " AND userID=" + user.getID();

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2007‐0329 ‐2007‐0329



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐4369 ‐2006‐4369



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2005‐0229 ‐2005‐0229 

REFERENCES

18



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Tes /index.php/Testing_for_busine ting_for_business_logic ss_logic



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Tes /index.php/Testing_for_Direc ting_for_Directory_Traversal tory_Traversal



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/C /index.php/Category:Access_C ategory:Access_Control_Vulnerabi ontrol_Vulnerability lity

OWASP Top 10 2007

Crosssiterequestforgeryi Crosssiterequestforgeryisnotanewatt snotanewattack,butissi ack,butissimpleandde mpleanddevastating.A vastating.ACSRFattackfor CSRFattackforcesalogged‐on cesalogged‐on victim’sbrowsertosenda victim’sbrowsertosendarequesttoav requesttoavulnerableweb ulnerablewebapplicati application,whichthe on,whichthenperformsthechosen nperformsthechosenactionon actionon behalfofthevictim behalfofthevictim,tothebenefit ,tothebenefitoftheattacker. oftheattacker.Thisvulner Thisvulnerabilityis abilityisextremelywi extremelywidespread,asanyw despread,asanyweb eb applicationthataut applicationthatauthorizesrequestsba horizesrequestsbasedonlyoncre sedonlyoncredentialstha dentialsthatareautomatic tareautomaticallysubmi allysubmittedbythebrowser ttedbythebrowseris is vulnerable.Unfortunatel vulnerable.Unfortunately,today,m y,today,mostwebapplic ostwebapplicationsrelysole ationsrelysolelyonautomat lyonautomaticallysubm icallysubmittedcredenti ittedcredentialssuchas alssuchas sessioncookies,Basic sessioncookies,BasicAuthenticati Authenticationcredential oncredentials,sourceIPaddre s,sourceIPaddresses,SSLcer sses,SSLcertificates,Wi tificates,Windowsdomain ndowsdomain credentials,etc. Thisvulnerabili Thisvulnerabilityisalsoknown tyisalsoknownbyseveral byseveralothernamesincl othernamesincludingSessi udingSessionRiding,One‐Cl onRiding,One‐ClickAttac ickAttacks,CrossSite ks,CrossSite ReferenceForgery,Hostile ReferenceForgery,HostileLinking, Linking,andAutomation andAutomationAttack.Theacr Attack.TheacronymXSRFisals onymXSRFisalsofrequently ofrequentlyused.OWASPand used.OWASPand MITREhavebothstandardize MITREhavebothstandardizedonthetermCross donthetermCrossSiteRequestForger SiteRequestForgeryandCSRF. yandCSRF.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletoCSRF. toCSRF.

VULNERABILITY AtypicalCSRFattac AtypicalCSRFattackagainstafor kagainstaforummighttake ummighttaketheformofdirecti theformofdirectingtheusertoinv ngtheusertoinvokesomefunc okesomefunction,suchas tion,suchas theapplication’sl theapplication’slogoutpage.Thefoll ogoutpage.Thefollowingtagi owingtaginanywebpagev nanywebpageviewedbythe iewedbythevictimwil victimwillgenerateare lgeneratearequest quest whichlogsthemout:

Ifanonlinebankall Ifanonlinebankalloweditsapplic oweditsapplicationtoproces ationtoprocessrequests,suc srequests,suchastransferfunds hastransferfunds,asimil ,asimilarattackmig arattackmightallow: htallow:

Bothoftheseattackswor Bothoftheseattacksworkbecausetheuser’ kbecausetheuser’sauthorizati sauthorizationcredential( oncredential(typicall typicallythesessioncookie) ythesessioncookie)would would automaticallybeinc automaticallybeincludedwithsuc ludedwithsuchrequestsbythebr hrequestsbythebrowser,eventhoug owser,eventhoughtheattackerdi htheattackerdidn’tsupply dn’tsupplythat that credential. Ifthetagcontainingthe Ifthetagcontainingtheattackca attackcanbepostedtoav nbepostedtoavulnerablea ulnerableapplicati pplication,thenthelik on,thenthelikelihoodoffi elihoodoffindingloggedi ndingloggedin n victimsissignific victimsissignificantlyincre antlyincreased,simi ased,similartothei lartotheincreaseinriskbe ncreaseinriskbetweenstoredandre tweenstoredandreflectedXSSfl flectedXSSflaws.XSSfl aws.XSSflaws aws arenotrequiredforaC arenotrequiredforaCSRFattacktow SRFattacktowork,althoughany ork,althoughanyapplicati applicationwithXSSfla onwithXSSflawsissuscepti wsissusceptibletoCSRFbec bletoCSRFbecause ause aCSRFattackcanexpl aCSRFattackcanexploittheXSSfl oittheXSSflawtostealany awtostealanynon‐automatic non‐automaticallysubmitte allysubmittedcredential dcredentialthatmight thatmightbeinplace beinplaceto to protectagainstaCSRFatta protectagainstaCSRFattack.Manyappl ck.Manyapplicationwor icationwormshaveusedbothtec mshaveusedbothtechniquesinc hniquesincombination. ombination. Whenbuildingdefensesa WhenbuildingdefensesagainstCSRFa gainstCSRFattacks,youmus ttacks,youmustalsofocus talsofocusoneliminati oneliminatingXSSvulner ngXSSvulnerabilitie abilitiesinyour sinyour applicationsincesuc applicationsincesuchflawsca hflawscanbeusedtogetar nbeusedtogetaroundmostCSRFdefensesy oundmostCSRFdefensesyoumightputi oumightputinplace. nplace.

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythattheapplic thattheapplicationprotec ationprotectsagainstCSRF tsagainstCSRFattacksbygener attacksbygeneratingand atingandthenrequirings thenrequiringsometype ometype ofauthorizationtoken ofauthorizationtokenthatisnotautoma thatisnotautomatically ticallysubmittedbythe submittedbythebrowser. browser.

19

Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscannersshould cannersshouldbeabletodetec beabletodetectthelac tthelackofCSRFprotection kofCSRFprotectioninapplic inapplications ations withalittlebitoftraining.Staticanalysistools,ontheotherhand,willhaveadifficulttimerecognizingacustom mechanismforprotectingagainstthisattack. Manualapproaches:Pene Manualapproaches:Penetrationtestingi trationtestingisaquickw saquickwaytoverify aytoverifythatCSRFprotec thatCSRFprotectionisinpla tionisinplace.Toveri ce.Toverifythatthe fythatthe mechanismisstrongandpr mechanismisstrongandproperlyimpleme operlyimplemented,checki nted,checkingthecodeisthe ngthecodeisthemosteffici mostefficientcourse. entcourse.

PROTECTION Applicationsmustens Applicationsmustensurethattheyarenot urethattheyarenotrelyingonc relyingoncredentialsortok redentialsortokensthatareaut ensthatareautomaticall omaticallysubmittedby ysubmittedby browsers.Theonlysoluti browsers.Theonlysolutionistouseac onistouseacustomtokenthatt ustomtokenthatthebrowserwill hebrowserwillnot‘remember’ not‘remember’andthenautoma andthenautomatically tically includewithaCSRFattack. Thefollowingstrategie Thefollowingstrategiesshouldbeinhere sshouldbeinherentinall ntinallwebapplicati webapplications: ons: 

EnsurethattherearenoXSSvul EnsurethattherearenoXSSvulnerabilitie nerabilitiesinyourappli sinyourapplication( cation(seeA1–CrossSi seeA1–CrossSiteScripting) teScripting)



Insertcustomrandomtokensi Insertcustomrandomtokensintoeveryformand ntoeveryformandURLthatwil URLthatwillnotbeautom lnotbeautomaticall aticallysubmittedbythe ysubmittedbythe browser.Forexample,

…

andthenverifythatthesub andthenverifythatthesubmittedtokeni mittedtokeniscorrectforthe scorrectforthecurrentuser. currentuser.Suchtokenscan Suchtokenscanbeuniquetotha beuniquetothat t particularfuncti particularfunctionorpageforthat onorpageforthatuser,orsimply user,orsimplyuniquetothe uniquetotheoverallsessi overallsession.Themorefoc on.Themorefocusedthe usedthe tokenistoaparticul tokenistoaparticularfunctionand arfunctionand/orparticul /orparticularsetofdata, arsetofdata,thestrongerthepr thestrongertheprotectionwill otectionwillbe,butthe be,butthe morecomplicateditwillbetoconstructandmaintain. 

Forsensitivedataorval Forsensitivedataorvaluetransacti uetransactions,re‐authentic ons,re‐authenticateorusetransac ateorusetransactionsigni tionsigningtoensurethat ngtoensurethatthe the requestisgenuine.Consider requestisgenuine.Considersendingane‐mai sendingane‐mailorphoni lorphoningthecustomeri ngthecustomeriftheacti ftheactivityseemssuspic vityseemssuspicious, ious, toalerttheuserandpotenti toalerttheuserandpotentiallybac allybackoutthetransac koutthetransaction. tion.



useGETrequests(URLs)forsensiti useGETrequests(URLs)forsensitivedataortoperform vedataortoperformvaluetra valuetransactions.Use nsactions.UseonlyPOST onlyPOST methodswhenprocessingsensiti methodswhenprocessingsensitivedatafrom vedatafromtheuser. theuser.



ForASP.NET,

(Seereferences).Thisprovides (Seereferences).Thisprovidesasimilar asimilartypeofchec typeofchecktoa ktoa

randomtokenasdescribedabove. Whilethesesuggestionswil Whilethesesuggestionswilldiminis ldiminishyourexposuredram hyourexposuredramaticall atically,advanced y,advancedCSRFattacksc CSRFattackscanbypassman anbypassmanyof yof theserestrictions.Thestronge theserestrictions.Thestrongesttechniquei sttechniqueistheuseofuni stheuseofuniquetokens,andel quetokens,andeliminati iminatingallXSSvul ngallXSSvulnerabili nerabilitiesin tiesin yourapplication.

SAMPLES

20



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2007‐0192 ‐2007‐0192



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐5116 ‐2006‐5116



MySpaceWormExplanationhttp://namb.la/popular/tech.html http://namb.la/popular/tech.html

OWASP Top 10 2007 

AnattackwhichusesQui AnattackwhichusesQuicktimetoper cktimetoperformCSRFattacks formCSRFattacks http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005607&intsr c=hm_list c=hm_list

REFERENCES 

OWASPCSRF,http://www.ow OWASPCSRF,http://www.owasp.org/index.php/C asp.org/index.php/Cross‐Site_Request_Forge ross‐Site_Request_Forgery ry



OWASP,https://www.owasp.org/index.php/Testing_for_CSRF OWASP,https://www.owasp.org/index.php/Testing_for_CSRF



OWASPCSRFGuard,http://www.owasp.org/index.php/CSRF_Guard OWASPCSRFGuard,http://www.owasp.org/index.php/CSRF_Guard



OWASPPHPCSRFGuard,http://www.owasp.org/index.php/PHP_CSRF_Guard http://www.owasp.org/index.php/PHP_CSRF_Guard



RSnake,"WhatisCSRF?",http://ha.ckers.org/blog/200 http://ha.ckers.org/blog/20061030/wha 61030/what‐is‐csrf/ t‐is‐csrf/



Microsoft,ViewStateUserKeydetails, http://msdn2.microsoft.com http://msdn2. microsoft.com/en‐us/librar /en‐us/library/ms972969.a y/ms972969.aspx#securitybarrie spx#securitybarriers_topic2 rs_topic2

21

Applicationscanunintentionallyleakinformationabouttheirconfiguration,internalworkings,orviolateprivacy throughavarietyofappl throughavarietyofapplicationpr icationproblems.Applic oblems.Applicationscanal ationscanalsoleaki soleakinternalstatevi nternalstateviahowlongthe ahowlongtheytaketo ytaketo processcertainoperati processcertainoperationsorviadiffe onsorviadifferentresponsestodi rentresponsestodifferinginputs, fferinginputs,suchasdispl suchasdisplayingthesamee ayingthesameerrortextwith rrortextwith differenterrornumbers.Web differenterrornumbers.Webapplicati applicationswillofte onswilloftenleakinform nleakinformationaboutthei ationabouttheirinternal rinternalstatethroughde statethroughdetailedor tailedor debugerrormessages.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletoinformationle toinformationleakageandi akageandimpropererrorhandli mpropererrorhandling. ng.

VULNERABILITY Applicationsfrequentl Applicationsfrequentlygenerateerr ygenerateerrormessagesanddis ormessagesanddisplaythemto playthemtousers.Manytimest users.Manytimestheseerrormessage heseerrormessagesare sare quiteusefultoattacker quiteusefultoattackers,astheyreve s,astheyrevealimplemen alimplementationdetail tationdetailsorinformati sorinformationthatisuseful onthatisusefulinexplori inexploringa nga vulnerability.There vulnerability.Thereareseveralc areseveralcommonexamples ommonexamplesofthis: ofthis: 

Detailederrorhandli Detailederrorhandling,whereinduci ng,whereinducinganerror nganerrordisplaystoomuc displaystoomuchinformation, hinformation,suchasstac suchasstacktraces, ktraces, failedSQLstatements, failedSQLstatements,orotherdebuggi orotherdebugginginformation. nginformation.



Functionsthatproducedi Functionsthatproducedifferentresults fferentresultsbasedupondifferenti basedupondifferentinputs.Forexample nputs.Forexample,supplyingthe ,supplyingthesame same usernamebutdifferentpassw usernamebutdifferentpasswordstoalogin ordstoaloginfunctionshoul functionshouldproducethesame dproducethesametextfornosuch textfornosuchuser,and user,and badpassword.However,manysy badpassword.However,manysystemsproduce stemsproducedifferenterrorc differenterrorcodes. odes.

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythattheapplic thattheapplicationdoesnotl ationdoesnotleakinformati eakinformationviaerror onviaerrormessagesorotherme messagesorothermeans. ans. Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscanningtool canningtoolscanandproba scanandprobablywill blywillcauseerrormes causeerrormessagestobegener sagestobegenerated. ated. Detectingwhetherthemessage Detectingwhetherthemessagesleakinform sleakinformationisthec ationisthechallenge.St hallenge.Staticanaly aticanalysistoolsca sistoolscansearchfort nsearchfortheuseof heuseof APIsthatleakinformati APIsthatleakinformation,butwill on,butwillnotbeableto notbeabletoverifytheme verifythemeaningofth aningofthosemessages. osemessages. Manualapproaches:Acode Manualapproaches:Acodereviewcan reviewcansearchforimpr searchforimpropererrorhandli opererrorhandlingandotherpatter ngandotherpatternsthatleak nsthatleak information,butitis information,butitistime‐consuming.Te time‐consuming.Testingwill stingwillalsogenera alsogenerateerrormessage teerrormessages,butknowingw s,butknowingwhaterrorpaths haterrorpaths werecoveredisachallenge.

PROTECTION Developersshouldusetool DevelopersshouldusetoolslikeOWASP's slikeOWASP'sWebScarabt WebScarabtotrytomakethei otrytomaketheirapplica rapplicationgenerateerr tiongenerateerrors.Applicat ors.Applications ions thathavenotbeentestedi thathavenotbeentestedinthiswaywil nthiswaywillalmostcer lalmostcertainlygener tainlygenerateunexpecte ateunexpectederroroutput.Appli derroroutput.Applicationsshoul cationsshould d alsoincludeastandarde alsoincludeastandardexceptionhandli xceptionhandlingarchitect ngarchitecturetoprevent uretopreventunwantedinfor unwantedinformationfromleaki mationfromleakingtoattacker ngtoattackers. s. Preventinginformationleaka Preventinginformationleakagerequiresdis gerequiresdiscipline. cipline.Thefollowi Thefollowingpractice ngpracticeshaveproveneffe shaveproveneffective: ctive: 

Ensurethattheentiresoftware Ensurethattheentiresoftwaredevelopment developmentteamsharesacom teamsharesacommonapproachtoexce monapproachtoexceptionhandli ptionhandling. ng.



Disableorlimit Disableorlimitdetailederrorha detailederrorhandling.I ndling.Inparticular nparticular,donotdispl ,donotdisplaydebuginformat aydebuginformationtoendusers, iontoendusers,stack stack traces,orpathinformation.

22

OWASP Top 10 2007 

Ensurethatsecurepathsthat Ensurethatsecurepathsthathavemultipl havemultipleoutcomesreturn eoutcomesreturnsimilar similaroridentical oridenticalerrormessagesi errormessagesin n roughlythesametime.I roughlythesametime.Ifthisisnotpossi fthisisnotpossible,consi ble,considerimposingar derimposingarandomwaittime andomwaittimeforalltra foralltransactionsto nsactionsto hidethisdetailfromthea hidethisdetailfromtheattacker. ttacker.

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐4899 ‐2006‐4899



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐3389 ‐2006‐3389



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2002‐0580 ‐2002‐0580

REFERENCES 

OWASP,http://www.owasp.org/index.php/Error_Handling OWASP,http://www.owasp.org/index.php/Error_Handling



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/C /index.php/Category:Sensitive ategory:Sensitive_Data_Protecti _Data_Protection_Vulnerabili on_Vulnerability ty

23

Properauthenticationand Properauthenticationandsessionmanageme sessionmanagementiscriti ntiscriticaltoweb caltowebapplicati applicationsecurity.Fl onsecurity.Flawsinthis awsinthisareamost areamost frequentlyinvolvethe frequentlyinvolvethefailure failuretoprotectcredenti toprotectcredentialsandsession alsandsessiontokensthrought tokensthroughtheirlifec heirlifecycle.These ycle.Theseflawscanle flawscanlead ad tothehijackingofuser tothehijackingofuseroradministrati oradministrativeaccounts, veaccounts,undermineauthori undermineauthorizationand zationandaccountabili accountabilitycontrols, tycontrols,andcause andcause privacyviolations.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletoauthenticati toauthenticationandsessi onandsessionmanagementfl onmanagementflaws. aws.

VULNERABILITY Flawsinthemainauthent Flawsinthemainauthenticationmec icationmechanismarenot hanismarenotuncommon,butweakne uncommon,butweaknessesaremoreofte ssesaremoreoftenintroduced nintroduced throughancillarya throughancillaryauthenticati uthenticationfunctionssuc onfunctionssuchaslogout,passw haslogout,passwordmanagement, ordmanagement,timeout,rememberme, timeout,rememberme,secret secret question,andaccountupdate.

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythattheapplic thattheapplicationproperly ationproperlyauthentic authenticatesusersandpr atesusersandproperlyprotects operlyprotectsidentities identitiesandtheir andtheir associatedcredentials. Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscanningtool canningtoolshaveavery shaveaverydifficult difficulttimedetectin timedetectingvulnerabil gvulnerabilitiesinc itiesincustom ustom authenticationandsessi authenticationandsessionmanagementscheme onmanagementschemes.Staticanal s.Staticanalysistoolsare ysistoolsarealsonotli alsonotlikelytodetec kelytodetectauthenticati tauthentication on andsessionmanagementproble andsessionmanagementproblemsincustomc msincustomcode. ode. Manualapproaches:Codere Manualapproaches:Codereviewand viewandtesting,especi testing,especiallyincombi allyincombination,are nation,arequiteeffec quiteeffectiveatveri tiveatverifyingthatthe fyingthatthe authentication,session authentication,sessionmanagement,and management,andancill ancillaryfunctionsare aryfunctionsareallimple allimplementedproperly. mentedproperly.

PROTECTION Authenticationrelies Authenticationreliesonsecurecommunic onsecurecommunicationandcr ationandcredentialstor edentialstorage.Firstens age.FirstensurethatSSLis urethatSSListheonlyoption theonlyoptionfor for allauthenticatedpa allauthenticatedpartsoftheappli rtsoftheapplication(see cation(seeA9–InsecureCo A9–InsecureCommunicati mmunications)andthatall ons)andthatallcredentials credentialsarestoredi arestoredin n hashedorencryptedform(see hashedorencryptedform(seeA8–InsecureC A8–InsecureCryptographic ryptographicStorage). Storage). Preventingauthenticati Preventingauthenticationflawstake onflawstakescarefulpla scarefulplanning.Amongthe nning.Amongthemostimportantc mostimportantconsiderationsa onsiderationsare: re: 

Useasingleauthentic Useasingleauthenticationmecha ationmechanismwithappropr nismwithappropriatestreng iatestrengthandnumberof thandnumberoffactors factors



Usethecontainerprovi Usethecontainerprovidedsessionmanage dedsessionmanagementmechanisman mentmechanismandnocustomcooki dnocustomcookies es



Createanewsessionuponsucc Createanewsessionuponsuccessfulauthenti essfulauthentication cation



Ensurethateverypagehas Ensurethateverypagehasalogoutli alogoutlink,andthatl nk,andthatlogoutdestroysal ogoutdestroysallserverside lserversidesessionstate sessionstateandclient andclient sidecookies



Ensureancillaryauthe Ensureancillaryauthenticationfunc nticationfunctions(questi tions(questionsandanswers, onsandanswers,passwordreset)are passwordreset)areasstrongasthe asstrongasthe mainonesanddon'tcontainflaws



24

exposeanycredentialsi exposeanycredentialsinURLsorlogs( nURLsorlogs(nosessionrewriti nosessionrewriting) ng)

OWASP Top 10 2007

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐6145 ‐2006‐6145 



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐6229 ‐2006‐6229 



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐6528 ‐2006‐6528 

REFERENCES 

OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/G /index.php/Guide_to_Authentic uide_to_Authentication ation



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Re /index.php/Reviewing_Code_for_ viewing_Code_for_Authentica Authentication tion



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Tes /index.php/Testing_for_authentic ting_for_authentication ation

25

Protectingsensitiveda Protectingsensitivedatawithcryptogr tawithcryptographyhasbec aphyhasbecomeakeypartof omeakeypartofmostwebapplic mostwebapplications.Simpl ations.Simplyfailing yfailingto to encryptsensitivedata encryptsensitivedataisverywi isverywidespread.Applic despread.Applicationsthatdoe ationsthatdoencryptfrequentl ncryptfrequentlycontainpoor ycontainpoorlydesigne lydesigned d cryptography,eitherusi cryptography,eitherusinginappropri nginappropriateciphersorma ateciphersormakingserious kingseriousmistakesusing mistakesusingstrongciphers. strongciphers.Theseflawsc Theseflawscan an leadtodisclosureofsensitivedataandcomplianceviolations.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletoinsecurecryptog toinsecurecryptographicstor raphicstorage. age.

VULNERABILITY Preventingcryptographic Preventingcryptographicflawstake flawstakescarefulpl scarefulplanning.Themostc anning.Themostcommonproblemsare ommonproblemsare: : 

Notencryptingsensitivedata



Usinghomegrownalgorithms



Insecureuseofstrongalgorithms



Continueduseofprovenweak Continueduseofprovenweakalgorithms(MD algorithms(MD5,SHA‐1,RC3, 5,SHA‐1,RC3,RC4,etc…) RC4,etc…)



Hardcodingkeys,andstori Hardcodingkeys,andstoringkeysi ngkeysinunprotectedstores nunprotectedstores

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythattheapplic thattheapplicationproperly ationproperlyencryptssens encryptssensitiveinfor itiveinformationinstor mationinstorage. age. Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscanningtool canningtoolscannotveri scannotverifycryptographi fycryptographicstoragea cstorageatall.Codesc tall.Codescanningtools anningtools candetectuseofknowncry candetectuseofknowncryptographicA ptographicAPIs,butcannotde PIs,butcannotdetectifiti tectifitisbeingusedpr sbeingusedproperlyorifthee operlyoriftheencryptioni ncryptionis s performedinanexternalcomponent. Manualapproaches:Lik Manualapproaches:Likescanning, escanning,testingcann testingcannotverifycr otverifycryptographicstor yptographicstorage.Codereview age.Codereviewisthebestw isthebestwayto ayto verifythatanapplic verifythatanapplicationencryp ationencryptssensitiveda tssensitivedataandhasprope taandhasproperlyimple rlyimplementedthemecha mentedthemechanismandkey nismandkey management.Thismayinvol management.Thismayinvolvetheexami vetheexaminationofthecon nationoftheconfigurati figurationofexternalsyste onofexternalsystemsinsomecases. msinsomecases.

PROTECTION Themostimportantaspecti Themostimportantaspectistoensurethate stoensurethateverythingthatshoul verythingthatshouldbeencrypted dbeencryptedisactuall isactuallyencrypted.The yencrypted.Thenyou nyou mustensurethatthecryptogr mustensurethatthecryptographyisimple aphyisimplementedproperly. mentedproperly.Astherearesomany Astherearesomanywaysofusi waysofusingcryptography ngcryptography improperly,thefoll improperly,thefollowingrecommendati owingrecommendationsshouldbet onsshouldbetakenaspartofyo akenaspartofyourtestingregim urtestingregimetohelpens etohelpensuresecure uresecure cryptographicmaterialshandling: 

allowunqualifiedstaf allowunqualifiedstafftotrytocre ftotrytocreatecryptograph atecryptographicalgori icalgorithms.Useonly thms.Useonlyapprovedpublic approvedpublic algorithmssuchasAES,RSA algorithmssuchasAES,RSApublickeyc publickeycryptography,and ryptography,andSHA‐256or SHA‐256orbetterforhashing. betterforhashing. 



26

useweakalgorithms,suc useweakalgorithms,suchasMD5/SHA1.F hasMD5/SHA1.Favorsaferal avorsaferalternatives, ternatives,suchasSHA‐256 suchasSHA‐256orbetter. orbetter.

OWASP Top 10 2007 

Generatekeysofflinea Generatekeysofflineandstoreprivat ndstoreprivatekeyswithe ekeyswithextremecare xtremecare



Ensurethatinfrastructurecre Ensurethatinfrastructurecredentials dentialssuchasdatabase suchasdatabasecredenti credentialsorMQqueuea alsorMQqueueaccessdetails ccessdetailsare are securelyencryptedandnote securelyencryptedandnoteasilydecry asilydecryptedbylocal ptedbylocalorremoteusers orremoteusers



Ensurethatencrypteddatas Ensurethatencrypteddatastoredondiskis toredondiskisnoteasytodecr noteasytodecrypt.Forexam ypt.Forexample,databasee ple,databaseencryptioni ncryptionis s worthlessifthedatabasec worthlessifthedatabaseconnectionpool onnectionpoolprovidesunencr providesunencryptedaccess. yptedaccess.Allthisdoes Allthisdoesisslowdownthe isslowdownthe databaseandmakequeriesv databaseandmakequeriesveryslow. eryslow.



UnderPCIDataSecuritySta UnderPCIDataSecurityStandardrequireme ndardrequirement3,youmustprotec nt3,youmustprotectcardhol tcardholderdata.PCIDS derdata.PCIDSScompliancei Scomplianceis s mandatoryby2008formerc mandatoryby2008formerchantsandany hantsandanyoneelsedeali oneelsedealingwithcre ngwithcreditcards.Good ditcards.Goodpracticeist practiceistonever onever storeunnecessarydata,suc storeunnecessarydata,suchasthemagnetic hasthemagneticstripeinformati stripeinformationortheprima onortheprimaryaccountnum ryaccountnumber(PAN, ber(PAN, otherwiseknownasthecreditc otherwiseknownasthecreditcardnumber).I ardnumber).IfyoustorethePAN, fyoustorethePAN,theDSScompli theDSScompliancerequire ancerequirementsare mentsare heftyandcontinuing.Fore heftyandcontinuing.Forexample,youare xample,youareNEVERallowed NEVERallowedtostoretheCVV tostoretheCVVnumber(thethreedig number(thethreedigit it numberontherearofthecar numberontherearofthecard)underanyci d)underanycircumstances. rcumstances.Formoreinformati Formoreinformation,pleaseseethe on,pleaseseethePCIDSS PCIDSS Guidelinesandimplement Guidelinesandimplementcontrolsasnec controlsasnecessary. essary.

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐6145 ‐2006‐6145



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2005‐1664 ‐2005‐1664



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐1999‐1101 ‐1999‐1101(TrueofmostJa (TrueofmostJavaEEservletc vaEEservletcontainers, ontainers, too)

REFERENCES 

OWASP,http://www.owasp.org/index.php/Cryptography OWASP,http://www.owasp.org/index.php/Cryptography



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/G /index.php/Guide_to_Cryptogr uide_to_Cryptography aphy



OWASP,http://www.owasp.org/index.php/Insecure_Storage OWASP,http://www.owasp.org/index.php/Insecure_Storage



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/How_to_ /index.php/How_to_protect_sensiti protect_sensitive_data_in_URL ve_data_in_URL’s ’s



PCIDataSecurityStandardv1.1, https://www.pcisecuritys https://www. pcisecuritystandards.org/pdfs tandards.org/pdfs/pci_dss_v1‐1 /pci_dss_v1‐1.pdf  .pdf 



BruceSchneier,http://www.schneier.com/ BruceSchneier, http://www.schneier.com/



CryptoAPINextGeneration,http://msdn2.microsoft.com/en‐us/l http://msdn2.microsoft.com/en‐us/library/aa ibrary/aa376210.as 376210.aspx px

27

Applicationsfrequentl Applicationsfrequentlyfailt yfailtoencryptnetwork oencryptnetworktrafficwhe trafficwhenitisnecessar nitisnecessarytoprotectsensit ytoprotectsensitivecommunic ivecommunications. ations. Encryption(usually Encryption(usuallySSL)mustbeusedf SSL)mustbeusedforallauthe orallauthenticatedconnec nticatedconnections,especi tions,especiallyinter allyinternetaccessi netaccessiblewebpages blewebpages butbackendconnections butbackendconnectionsaswell.O aswell.Otherwise,theappli therwise,theapplicationwill cationwillexposeanauthe exposeanauthenticati nticationorsessiontoken.I onorsessiontoken.In n addition,encryptionshoul addition,encryptionshouldbeusedwheneverse dbeusedwheneversensitivedata, nsitivedata,suchascredi suchascreditcardorheal tcardorhealthinformati thinformationis onis transmitted.Applicati transmitted.Applicationsthatfall onsthatfallbackorcanbe backorcanbeforcedoutofane forcedoutofanencryptingmodec ncryptingmodecanbeabusedby anbeabusedbyattackers. attackers. ThePCIstandardrequires ThePCIstandardrequiresthatallcre thatallcreditcardinfor ditcardinformationbein mationbeingtransmitted gtransmittedovertheinternet overtheinternetbeencrypted. beencrypted.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletoinsecurecommuni toinsecurecommunications. cations.

VULNERABILITY Failuretoencryptsensi Failuretoencryptsensitivecommuni tivecommunicationsmea cationsmeansthatanattac nsthatanattackerwhocan kerwhocansnifftraffic snifftrafficfromthenetw fromthenetworkwillbe orkwillbe abletoaccessthec abletoaccesstheconversation,i onversation,includingany ncludinganycredential credentialsorsensitive sorsensitiveinformati informationtransmitted. ontransmitted.Considerthat Considerthat differentnetworkswill differentnetworkswillbemoreorlesssusc bemoreorlesssusceptiblet eptibletosniffing.Howe osniffing.However,itisi ver,itisimportanttoreal mportanttorealizethatev izethateventually entuallya a hostwillbecompromisedon hostwillbecompromisedonalmosteveryne almosteverynetwork,andattac twork,andattackerswill kerswillquicklyi quicklyinstallas nstallasniffertoc niffertocapturethe apturethe credentialsofothersystems. UsingSSLforcommunic UsingSSLforcommunicationswithend ationswithendusersiscri usersiscritical,as tical,astheyarevery theyareverylikely likelytobeusinginsec tobeusinginsecurenetworksto urenetworksto accessapplicatio accessapplications.BecauseHTTPi ns.BecauseHTTPincludesauthent ncludesauthenticationcr icationcredentials edentialsorasessiontokenw orasessiontokenwitheverysi itheverysinglerequest, nglerequest, allauthenticatedt allauthenticatedtrafficneeds rafficneedstogooverSSL,not togooverSSL,notjusttheactual justtheactualloginre loginrequest. quest. Encryptingcommunicati Encryptingcommunicationswithbacke onswithbackendserversisal ndserversisalsoimportant. soimportant.Althoughthese Althoughthesenetworksarelik networksarelikelytobemore elytobemore secure,theinformation secure,theinformationandcredenti andcredentialstheycarr alstheycarryismoresensi yismoresensitiveandmoreexte tiveandmoreextensive.Therefore nsive.ThereforeusingSSLon usingSSLon thebackendisquiteimportant. Encryptingsensitiveda Encryptingsensitivedata,suchasc ta,suchascreditcardsa reditcardsandsocial ndsocialsecuritynumbers, securitynumbers,hasbecomea hasbecomeaprivacyand privacyandfinancial financial regulationformanyorg regulationformanyorganizations.Neg anizations.Neglectingtouse lectingtouseSSLforconnecti SSLforconnectionshandlingsuc onshandlingsuchdatacreates hdatacreatesacomplia acompliance nce risk.

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythattheapplic thattheapplicationproperly ationproperlyencryptsal encryptsallauthenti lauthenticatedandsensi catedandsensitivecommunic tivecommunications. ations. Automatedapproaches:Vul Automatedapproaches:Vulnerabilitys nerabilityscanningtool canningtoolscanverifytha scanverifythatSSLis tSSLisusedonthefrontend, usedonthefrontend,andcanfin andcanfindmany dmany SSLrelatedflaws.However SSLrelatedflaws.However,thesetoolsdo ,thesetoolsdonothaveacce nothaveaccesstobackendc sstobackendconnectionsa onnectionsandcannotverify ndcannotverifythattheyare thattheyare secure.Staticanalys secure.Staticanalysistoolsmay istoolsmaybeabletohel beabletohelpwithanal pwithanalyzingsomec yzingsomecallstoback allstobackendsystems,but endsystems,butprobablywill probablywill notunderstandthecustomlogi notunderstandthecustomlogicrequiredfor crequiredforalltypesof alltypesofsystems. systems. Manualapproaches:Testi Manualapproaches:Testingcanverify ngcanverifythatSSLis thatSSLisusedandfindmany usedandfindmanySSLrelatedfl SSLrelatedflawsonthefronte awsonthefrontend,butthe nd,butthe automatedapproachesarepr automatedapproachesareprobablymoree obablymoreefficient.C fficient.Codereviewi odereviewisquiteeffic squiteefficientforveri ientforverifyingtheproper fyingtheproperuseof useof SSLforallbackendconnec SSLforallbackendconnections. tions.

28

OWASP Top 10 2007

PROTECTION Themostimportantprotectioni ThemostimportantprotectionistouseSSLonany stouseSSLonanyauthentic authenticatedconnec atedconnectionorwhenevers tionorwheneversensitivedata ensitivedataisbeing isbeing transmitted.Thereareanumber transmitted.Thereareanumberofdetail ofdetailsinvolvedwi sinvolvedwithconfig thconfiguringSSLforwe uringSSLforwebapplicat bapplicationsproperly, ionsproperly,so so understandingandanalyzi understandingandanalyzingyourenviron ngyourenvironmentisimpor mentisimportant. tant. 

UseSSLforallconnec UseSSLforallconnectionsthatare tionsthatareauthenticate authenticatedortransmitti dortransmittingsensitive ngsensitiveorvaluedat orvaluedata,suchas a,suchas credentials,creditcarddetails,healthandotherprivateinformation.



Ensurethatcommunications Ensurethatcommunicationsbetweeninfra betweeninfrastructureelements, structureelements,suchasbetweenw suchasbetweenwebserversan ebserversand d databasesystemsareappropri databasesystemsareappropriatelyprotec atelyprotectedviatheuse tedviatheuseoftransportl oftransportlayersecurit ayersecurityorprotocollev yorprotocollevel el encryptionforcredentialsandintrinsicvaluedata.



IE7.0providesagreenbarfor IE7.0providesagreenbarforhightrustSSL hightrustSSLcertific certificates,butthisi ates,butthisisnotasuitable snotasuitablecontroltopr controltoprovesafeuse ovesafeuse ofcryptographyalone.It ofcryptographyalone.Itjustmeansyou justmeansyoupaidalotm paidalotmoreforacertific oreforacertificatethanmostfol atethanmostfolks. ks.



UnderPCIDataSecuritySta UnderPCIDataSecurityStandardrequireme ndardrequirement4,youmustprotec nt4,youmustprotectcardhol tcardholderdataintrans derdataintransit.PCIDSS it.PCIDSS complianceismandator complianceismandatoryby2008 yby2008formerchantsand formerchantsandanyoneelse anyoneelsedealingwit dealingwithcreditc hcreditcards.Ingeneral, ards.Ingeneral, client,partner,staff clie nt,partner,staffandadminis andadministrativeonli trativeonlineaccesstosystem neaccesstosystemsmustbeencry smustbeencryptedusingSSLor ptedusingSSLorsimilar. similar. Formoreinformation,ple Formoreinformation,pleaseseethePCID aseseethePCIDSSGuidelinesa SSGuidelinesandimpleme ndimplementcontrolsas ntcontrolsasnecessary. necessary.

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐6430 ‐2006‐6430



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2005‐4704 ‐2005‐4704 



http://www.schneier.com/bl http://www.sc hneier.com/blog/archives/ og/archives/2005/10/sc 2005/10/scandinavian_ andinavian_at_1.html at_1.html 

REFERENCES 

OWASPTestingGuide ,TestingforSSL/TLS, ,TestingforSSL/TLS,https://www.owasp.org/index.php/Te https://www.owasp.org/index.php/Testing_for_SSL‐TL sting_for_SSL‐TLSS



OWASPGuide,http://www.owas OWASPGuide,http://www.owasp.org/index.php/G p.org/index.php/Guide_to_Crypt uide_to_Cryptography ography



Foundstone‐SSLDigger, http://www.foundstone.com/i http://www.foun dstone.com/index.htm?subnav=serv ndex.htm?subnav=services/navig ices/navigation.htm&subc ation.htm&subcontent=/service ontent=/services/overvie s/overvie w_s3i_des.htm w_s3i_des.htm



NIST,SP800‐52Guideli NIST,SP800‐52Guidelinesfortheselec nesfortheselectionanduseo tionanduseoftransportlaye ftransportlayersecurity(TL rsecurity(TLS)Implementati S)Implementations, ons, http://csrc.nist.gov/publ http://csrc. nist.gov/publications ications/nistpubs/800 /nistpubs/800‐52/SP800‐52.pdf  ‐52/SP800‐52.pdf 



NISTSP800‐95Guidetosec NISTSP800‐95Guidetosecurewebservic urewebservices, es,http://csrc. http://csrc.nist.gov/publi nist.gov/publications/dr cations/drafts.html#sp800‐9 afts.html#sp800‐95 5

29

Frequently,theonlyprote Frequently,theonlyprotectionforaU ctionforaURListhatli RListhatlinkstothatpage nkstothatpagearenotpresentedt arenotpresentedtounauthorized ounauthorizedusers. users. However,amotivated,sk However,amotivated,skilled,orj illed,orjustplainl ustplainluckyattac uckyattackermaybeabl kermaybeabletofindanda etofindandaccessthesepage ccessthesepages,invoke s,invoke functions,andviewda functions,andviewdata.Securit ta.Securitybyobscurityi ybyobscurityisnotsufficient snotsufficienttoprotectsen toprotectsensitivefunc sitivefunctionsanddat tionsanddatainan ainan application.Accessc application.Accesscontrolchecks ontrolchecksmustbeperformedbe mustbeperformedbeforearequesttoasens forearequesttoasensitivefunc itivefunctionisgra tionisgrantedwhich ntedwhich ensuretheuserisauthorize ensuretheuserisauthorizedtoaccess dtoaccessthatfunction. thatfunction.

ENVIRONMENTSAFFECTED Allwebapplicati Allwebapplicationframeworksare onframeworksarevulnerable vulnerabletofailuretore tofailuretorestrictURL strictURLaccess. access.

VULNERABILITY Theprimaryattackmeth Theprimaryattackmethodforthisvul odforthisvulnerability nerabilityiscalle iscalled"forcedbrowsi d"forcedbrowsing",whichenc ng",whichencompassesguessingl ompassesguessinglinksand inksand bruteforcetechniquestofi bruteforcetechniquestofindunprotected ndunprotectedpages.Applica pages.Applicationsfrequentl tionsfrequentlyallowacce yallowaccesscontrolc sscontrolcodetoevolveand odetoevolveand spreadthroughoutacodebase spreadthroughoutacodebase,resultingi ,resultinginacomplexm nacomplexmodelthatis odelthatisdifficult difficulttounderstandforde tounderstandfordevelopersand velopersand securityspecialistsalike.Thiscomplexitymakesitlikelythaterrorswilloccurandpageswillbemissed,leaving themexposed. Somecommonexamplesofthesefl Somecommonexamplesoftheseflawsinclude: awsinclude: 

"Hidden"or"special"U "Hidden"or"special"URLs,rendered RLs,renderedonlytoadmini onlytoadministratorsorpri stratorsorprivilegedusers vilegedusersintheprese inthepresentationlayer, ntationlayer, butaccessibletoall butaccessibletoallusersift usersiftheyknowitexist heyknowitexists,suchas/admi s,suchas/admin/adduser.phpor n/adduser.phpor/approveTrans /approveTransfer.do.This fer.do.This isparticularlyprevalentwithmenucode.



Applicationsoftenal Applicationsoftenallowaccess lowaccessto"hidden"file to"hidden"files,suchasstati s,suchasstaticXMLorsys cXMLorsystemgeneratedreports temgeneratedreports,trusting ,trusting securitythroughobscurity securitythroughobscuritytohidethem. tohidethem.



Codethatenforcesanacc Codethatenforcesanaccesscontrolp esscontrolpolicybuti olicybutisoutofdateorins soutofdateorinsufficient. ufficient.Forexample,i Forexample,imagine magine /approveTransfer.dowasonce /approveTransfer.dowasonceavaila availabletoalluse bletoallusers,butsince rs,butsinceSOXcontrolswere SOXcontrolswerebroughtin,i broughtin,itisonly tisonly supposedtobeavailable supposedtobeavailabletoapprovers.A toapprovers.Afixmighthav fixmighthavebeentonotpre ebeentonotpresentittounauthor sentittounauthorizedusers, izedusers,but but noaccesscontrolisac noaccesscontrolisactuallyenforc tuallyenforcedwhenrequesti edwhenrequestingthatpage. ngthatpage.



Codethatevaluatespriv Codethatevaluatesprivilegesonthe ilegesontheclientb clientbutnotontheserver, utnotontheserver,asinthi asinthis sattackonMacWorld2007, attackonMacWorld2007, whichapproved"Plati whichapproved"Platinum"passesworth$1 num"passesworth$1700viaJa 700viaJavaScriptonthebr vaScriptonthebrowserratherthan owserratherthanontheserver. ontheserver.

VERIFYINGSECURITY Thegoalistoverify Thegoalistoverifythataccessc thataccesscontrolisenforce ontrolisenforcedconsistentl dconsistentlyintheprese yinthepresentationla ntationlayerandthebusi yerandthebusinesslogicfor nesslogicfor allURLsintheapplication. Automatedapproaches:Both Automatedapproaches:Bothvulnerabili vulnerabilityscannersandsta tyscannersandstaticanal ticanalysistoolsh ysistoolshavediffic avedifficultywithveri ultywithverifyingURL fyingURL accesscontrol,butfor accesscontrol,butfordifferentre differentreasons.Vulnerabil asons.Vulnerabilityscanners ityscannershavediffic havedifficultyguessing ultyguessinghiddenpagesa hiddenpagesand nd determiningwhichpages determiningwhichpagesshouldbeall shouldbeallowedforeachuser, owedforeachuser,whilesta whilestaticanalysi ticanalysisenginesstr senginesstruggletoidenti uggletoidentifycustom fycustom accesscontrolsinthec accesscontrolsinthecodeandlin odeandlinkthepresentati kthepresentationlayerwith onlayerwiththebusinesslogi thebusinesslogic. c. Manualapproaches:Themo Manualapproaches:Themostefficie stefficientandaccura ntandaccurateapproachist teapproachistouseacombinati ouseacombinationofcodereview onofcodereviewandsecurit andsecurity y testingtoverifythe testingtoverifytheaccesscontrol accesscontrolmechanism.If mechanism.Ifthemechanismi themechanismiscentralize scentralized,theveri d,theverificationc ficationcanbequite anbequite efficient.Ifthemecha efficie nt.Ifthemechanismisdis nismisdistributedacros tributedacrossanentirec sanentirecodebase,veri odebase,verificationc ficationcanbemoretime‐c anbemoretime‐consuming.If onsuming.If themechanismisenforcede themechanismisenforcedexternally(We xternally(WebSEALorSiteMi bSEALorSiteMinder),theconfig nder),theconfigurationmustbeex urationmustbeexaminedandteste aminedandtested. d.

30

OWASP Top 10 2007

PROTECTION Takingthetimetopl Takingthetimetoplanauthorizati anauthorizationbycreating onbycreatingamatrixtomap amatrixtomaptherolesan therolesandfunctionsofthe dfunctionsoftheapplica applicationisake tionisakey y stepinachievingprotec stepinachievingprotectionagains tionagainstunrestrictedUR tunrestrictedURLaccess.Web Laccess.Webapplic applicationsmustenforce ationsmustenforceaccesscon accesscontrolon trolon everyURLandbusinessfunc everyURLandbusinessfunction.Itis tion.Itisnotsufficient notsufficienttoputaccessc toputaccesscontrolintothe ontrolintothepresentationl presentationlayerandleave ayerandleavethe the businesslogicunprotec businesslogicunprotected.Itisals ted.Itisalsonotsufficie onotsufficienttocheckonc nttocheckonceduring eduringtheprocesstoensure theprocesstoensuretheuseris theuseris authorized,andthennot authorized,andthennotcheckagai checkagainonsubsequentsteps. nonsubsequentsteps.Otherwise,a Otherwise,anattackerca nattackercansimplyski nsimplyskipthestepwhere pthestepwhere authorizationischec authorizationischecked,andforgethe ked,andforgetheparameterv parametervaluesnecessar aluesnecessarytocontinueon ytocontinueonatthenextstep. atthenextstep. EnablingURLaccessc EnablingURLaccesscontroltakesso ontroltakessomecarefulpl mecarefulplanning.Amongthe anning.Amongthemostimportantc mostimportantconsiderations onsiderationsare: are: 

Ensurethattheenforcementofy Ensurethattheenforcementofyouraccessc ouraccesscontrolmatrixis ontrolmatrixispartofthebusi partofthebusiness,architec ness,architecture,anddesig ture,anddesign n oftheapplication.



EnsurethatallURLsa EnsurethatallURLsandbusinessfuncti ndbusinessfunctionsareprotectedb onsareprotectedbyaneffective yaneffectiveaccessc accesscontrolmechanism ontrolmechanismthat that verifiestheuser’srole verifiestheuser’sroleandentitlemen andentitlementspriortoa tspriortoanyprocessingt nyprocessingtakingplace. akingplace.Makesurethisi Makesurethisisdone sdone duringeverystepofthewa duringeverystepoftheway,notjustonce y,notjustoncetowardsthebeginni towardsthebeginningofanymul ngofanymulti‐stepprocess. ti‐stepprocess.



Performapenetrationtestpri Performapenetrationtestpriortodeploymen ortodeploymentorcodedeliver torcodedeliverytoensurethat ytoensurethattheapplicati theapplicationcannotbe oncannotbe misusedbyamotivatedskil misusedbyamotivatedskilledattacker. ledattacker.



assumethatuserswillbe assumethatuserswillbeunawareofspeci unawareofspecialorhiddenU alorhiddenURLsorAPIs.Alw RLsorAPIs.Alwaysensurethat aysensurethat administrativeandhighprivilegeactionsareprotected.



toallfiletypesthat toallfiletypesthatyourapplic yourapplicationshouldnever ationshouldneverserve.Ideal serve.Ideally,this ly,thisfilterwould filterwouldfollowthe followthe "acceptknowngood"approac "acceptknowngood"approachandonlyal handonlyallowfile lowfiletypesthatyoui typesthatyouintendtoserve,e.g ntendtoserve,e.g.,.html,.pdf, .,.html,.pdf,.php. .php. Thiswouldthenblocka Thiswouldthenblockanyattemptstoac nyattemptstoaccesslogfil cesslogfiles,xmlfiles es,xmlfiles,etc.thaty ,etc.thatyouneverinte ouneverintendtoserve ndtoserve directly.

SAMPLES 

http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2007‐0147 ‐2007‐0147



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2007‐0131 ‐2007‐0131 



http://cve.mitre.org/cgi http://cve. mitre.org/cgi‐bin/cvename.c ‐bin/cvename.cgi?name=CVE gi?name=CVE‐2006‐1227 ‐2006‐1227 

REFERENCES 

OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/Tes /index.php/Testing_for_Direc ting_for_Directory_Traversal tory_Traversal



OWASP,http://www.owasp.org/index.php/Forced_browsing OWASP,http://www.owasp.org/index.php/Forced_browsing



OWASP,http://www.owasp.org OWASP,http://www.owasp.org/index.php/G /index.php/Guide_to_Authorizat uide_to_Authorization ion

31

TheOWASPTop10isjustthe TheOWASPTop10isjustthebeginningofy beginningofyourwebapplic ourwebapplicationsecuri ationsecurityjourney. tyjourney. Theworld'ssixbillionpeoplecanbedividedintotwogroups:groupone,whoknowwhyeverygoodsoftware companyshipsproductswithknownbugs;andgrouptwo,whodon't.Thoseingroup1tendtoforgetwhatlife waslikebeforeouryouthfuloptimismwasspoiledbyreality.Sometimesweencounterapersoningrouptwo …whoisshockedthatanysoftwarecompanywouldshipaproductbeforeeverylastbugisfixed. EricSink,GuardianMay25,2006

Mostofyourusersandcustomers Mostofyourusersandcustomersareingrouptwo. areingrouptwo.Howyoudealwi Howyoudealwiththisproblemi ththisproblemisanopportuni sanopportunitytoimprove tytoimprove yourcodeandthestateofwe yourcodeandthestateofwebapplicati bapplicationsecurityi onsecurityingeneral.Bi ngeneral.Billionsof llionsofdollarsarel dollarsarelosteveryyear, osteveryyear,andmany andmany millionsofpeoplesuffe millionsofpeoplesufferidentit ridentitytheftandfraud ytheftandfraudduetothevulne duetothevulnerabilitie rabilitiesdiscussedi sdiscussedinthisdocument. nthisdocument.

FORARCHITECTSANDDESIGNERS Toproperlysecureyourappli Toproperlysecureyourapplications,you cations,youmustknowwhatyou’re mustknowwhatyou’resecuring( securing(assetclassi assetclassification), fication),knowthethreats knowthethreats andrisksofinsecuri andrisksofinsecurity,andaddress ty,andaddresstheseinastruc theseinastructuredway.Desig turedway.Designinganynon‐t ninganynon‐trivial rivialapplica applicationrequiresagoo tionrequiresagood d doseofsecurity. 

Ensurethatyouapply"juste Ensurethatyouapply"justenough"securit nough"securitybaseduponthreatr ybaseduponthreatriskmodeli iskmodelingandassetcl ngandassetclassificati assification on



Askquestionsaboutbusiness Askquestionsaboutbusinessrequirements,par requirements,particularly ticularlymissingnon‐func missingnon‐functionalreq tionalrequirements uirements



WorkthroughtheOWASPSecureSoftwareContractAnnex WorkthroughtheOWASPSecureSoftwareContractAnnexwithyourcustomer



Encouragesaferdesign–i Encouragesaferdesign–includedefensei ncludedefenseindepthandsim ndepthandsimplerconstruc plerconstructs ts



Ensurethatyouhaveconsideredconfidentiality,integrity,andavailability



Ensureyourdesignsareconsis Ensureyourdesignsareconsistentwithsec tentwithsecuritypolic uritypolicyandstandards yandstandards,suchasCOB ,suchasCOBITorPCIDSS1. ITorPCIDSS1.1 1

FORDEVELOPERS Manydevelopersalready Manydevelopersalreadyhaveagoodhand haveagoodhandleonwebappl leonwebapplicationsec icationsecuritybasics. uritybasics.Toensureeffect Toensureeffectivemastery ivemasteryof of thewebapplicationsecuri thewebapplicationsecuritydomainre tydomainrequirespracti quirespractice.Anyonecan ce.Anyonecandestroy(i.e. destroy(i.e.performpenetrati performpenetrationtesting)–i ontesting)–it t takesamastertobuildsec takesamastertobuildsecuresoftware.Ai uresoftware.Aimtobecomeamaste mtobecomeamaster. r.

32



Consider joiningOWASPandattending  joiningOWASPandattendinglocalchapter localchaptermeetings meetings



Askforsecurecodetrai Askforsecurecodetrainingifyou ningifyouhaveatraini haveatrainingbudget.Askfor ngbudget.Askforatraining atrainingbudgetifyou budgetifyoudon’thaveone don’thaveone



Designyourfeaturessecure Designyourfeaturessecurely–consi ly–considerdefenseindepth derdefenseindepthandsimplici andsimplicityindesign tyindesign



Adoptcodingstandardswhic Adoptcodingstandardswhichencouragesafer hencouragesafercodeconstruct codeconstructs s



Refactorexistingcodet Refactorexistingcodetousesaferconstruc ousesaferconstructsinyourchosenpl tsinyourchosenplatform,such atform,suchasparameterize asparameterizedqueries dqueries

OWASP Top 10 2007 

ReviewtheOWASPGuide ReviewtheOWASPGuideandstarta andstartapplyingselec pplyingselectedcontrolst tedcontrolstoyourcode.Unli oyourcode.Unlikemostsecurityg kemostsecurityguides, uides, itisdesignedtohelp itisdesignedtohelpyoubuildsec youbuildsecuresoftware,notbre uresoftware,notbreakit akit



Testyourcodeforsecurity Testyourcodeforsecuritydefectsandma defectsandmakethispartof kethispartofyourunitandwe yourunitandwebtestingregime btestingregime



Buyacopyof"TheSecurityDevelopmentLifecycle "(see[HOW1]inthebookr "(see[HOW1]inthebookreferences)and eferences)andadoptmany adoptmany ofitspractices.

FOROPENSOURCEPROJECTS Opensourceisapartic Opensourceisaparticularchalle ularchallengeforwebappli ngeforwebapplicationsecuri cationsecurity.Thereareli ty.Thereareliterallymil terallymillionsof lionsofopensource opensource projects,fromonedevel projects,fromonedeveloperpersonal"i operpersonal"itches"throughtoma tches"throughtomajorprojectssuc jorprojectssuchasApache,Tomc hasApache,Tomcat,andlarge at,andlargescale scale webapplications,suc webapplications,suchasPostNuke. hasPostNuke. 

Consider joiningOWASPandattending  joiningOWASPandattendinglocalchapter localchaptermeetings meetings



Ifyourprojecthasmorethan4 Ifyourprojecthasmorethan4developers,c developers,considermaki onsidermakingatleastonede ngatleastonedeveloperasec veloperasecurityperson urityperson



Designyourfeaturessecure Designyourfeaturessecurely–consi ly–considerdefenseindepth derdefenseindepthandsimplici andsimplicityindesign tyindesign



Adoptcodingstandardswhic Adoptcodingstandardswhichencouragesafer hencouragesafercodeconstruct codeconstructs s



Adopttheresponsiblediscl Adopttheresponsibledisclosurepolic osurepolicytoensurethatsec ytoensurethatsecuritydefectsa uritydefectsarehandled rehandledproperly properly



Buyacopyof"TheSecurityDevelopmentLifecycle "andadoptmanyofitspractices.

FORAPPLICATIONOWNERS Applicationownersin Applicationownersincommercial commercialsettingsareofte settingsareoftentimeandresource ntimeandresourceconstraine constrained.Applicati d.Applicationownersshould: onownersshould: 

WorkthroughtheOWASPSecureSoftwareContractAnnex WorkthroughtheOWASPSecureSoftwareContractAnnexwiththesoftwareproducers



Ensurebusinessrequirementsi Ensurebusinessrequirementsincludenon‐func ncludenon‐functionalrequi tionalrequirements(NFRs)s rements(NFRs)suchassecuri uchassecurityrequirements tyrequirements



Encouragedesignswhic Encouragedesignswhichincludesecure hincludesecurebydefaul bydefaultfeatures,defe tfeatures,defenseindepthandsi nseindepthandsimplicity mplicityindesign indesign



Employ(ortrain)developer Employ(ortrain)developerswhohaveastr swhohaveastrongsecuritybackg ongsecuritybackground round



Testforsecuritydefectsthrou Testforsecuritydefectsthroughouttheprojec ghouttheproject:design,build, t:design,build,test,andde test,anddeployment ployment



Allowresources,budgeta Allowresources,budgetandtimeinthe ndtimeintheprojectplant projectplantoremediatesecuri oremediatesecurityissues tyissues

FORC‐LEVELEXECUTIVES Yourorganizationmusthave Yourorganizationmusthaveasecuredevel asecuredevelopmentlife opmentlifecycle(SD cycle(SDLC)inpl LC)inplacethatsui acethatsuitsyourorganizat tsyourorganization.A ion.A reasonableSDLCnotonl reasonableSDLCnotonlyincludestesti yincludestestingfortheTop1 ngfortheTop10,itinclu 0,itincludes: des: 

Forofftheshelfsoftware,e Forofftheshelfsoftware,ensurepurchasi nsurepurchasingpolicie ngpoliciesandcontractsi sandcontractsincludesecuri ncludesecurityrequirements tyrequirements



Forcustomcode,adoptsecure Forcustomcode,adoptsecurecodingprinci codingprinciplesinyo plesinyourpoliciesa urpoliciesandstandards ndstandards

33

34



Trainyourdevelopersi Trainyourdevelopersinsecurecoding nsecurecodingtechniquesande techniquesandensuretheykeep nsuretheykeeptheseskill theseskillsuptodate suptodate



Trainyourarchitects, Trainyourarchitects,designers,and designers,andbusinesspeoplei businesspeopleinwebapplic nwebapplicationsecuri ationsecurityfundamental tyfundamentals s



Adopttheresponsiblediscl Adopttheresponsibledisclosurepolic osurepolicytoensurethatsec ytoensurethatsecuritydefectsa uritydefectsarehandled rehandledproperly properly

OWASP Top 10 2007

OWASPPROJECTS OWASPisthepremiersitefor OWASPisthepremiersiteforwebapplic webapplicationsecuri ationsecurity.The ty.TheOWASPsite OWASPsitehostsmany hostsmanyprojects projects, ,forums forums, ,blogs blogs, , presentations, presentations ,tools tools,and ,andpapers papers.OWASPhoststwomajor .OWASPhoststwomajorwebapplicationsecuri webapplicationsecurityconferences tyconferencesperyear,andhas peryear,andhas over80localchapters over80local chapters. . ThefollowingOWASPprojec ThefollowingOWASPprojectsaremostli tsaremostlikelytobeuseful kelytobeuseful: : 

OWASPGuidetoBuildingSe OWASPGuidetoB uildingSecureWebApplic cureWebApplications ations



OWASPTestingGuide



OWASPCodeReviewProject(indevelopment) OWASPCodeReviewProject (indevelopment)



OWASPPHPProject(indevelopment) OWASPPHPProject (indevelopment)



OWASPJavaProject OWASPJavaProject



OWASP.NETProject

BOOKS 

[GAL1]GallagherT.,LandauerL.,JeffriesB.," HuntingSecurityBugs ",MicrosoftPress,ISBN073562187X



[HOW1]HowardM.,LipnerS.,"TheSecurityDevelopmentLifecycle ",MicrosoftPress,ISBN0735622140



[HOW2]HowardM.,LeBla [HOW2]HowardM.,LeBlancD.,"Writ ncD.,"WritingSecureC ingSecureCode",2nded., ode",2nded.,MicrosoftPress,I MicrosoftPress,ISBN07356 SBN0735617228 17228



[SCH1]SchneierB.,"PracticalCryptography ",Wiley,ISBN047122894X

WEBSITES 

OWASP,http://www.owasp.org OWASP,http://www.owasp.org



MITRE,CommonWeaknesses–Vulner MITRE,CommonWeaknesses–VulnerabilityTre abilityTrends, nds,http://cwe.mi http://cwe.mitre.org/documents/vul tre.org/documents/vuln‐trends.html n‐trends.html



SANSTop20,http://www.sans.org/top20/ SANSTop20,http://www.sans.org/top20/



PCISecurityStandardsC PCISecurityStandardsCouncil,publi ouncil,publishersofthePCI shersofthePCIstandards,rele standards,relevanttoall vanttoallorganizati organizationsprocessing onsprocessingor or holdingcreditcarddata, https://www.pcisecuritystandards.org/



PCIDSSv1.1,https://www.pcise PCIDSSv1.1, https://www.pcisecuritysta curitystandards.org/pdfs/pci ndards.org/pdfs/pci_dss_v1‐1.pdf  _dss_v1‐1.pdf 



BuildSecurityIn,USCERT, https://buildsec https://buildsecurityin.us‐cer urityin.us‐cert.gov/daisy/bs t.gov/daisy/bsi/home.html i/home.html

35