80 lines
3.2 KiB
Plaintext
80 lines
3.2 KiB
Plaintext
Setting JavaBean properties is security sensitive. Doing it with untrusted values has led in the past to the following vulnerability:
|
|
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114[CVE-2014-0114]
|
|
|
|
JavaBeans can have their properties or nested properties set by population functions. An attacker can leverage this feature to push into the JavaBean malicious data that can compromise the software integrity. A typical attack will try to manipulate the ClassLoader and finally execute malicious code.
|
|
|
|
|
|
This rule raises an issue when:
|
|
|
|
* BeanUtils.populate(...) or BeanUtilsBean.populate(...) from http://commons.apache.org/proper/commons-beanutils/[Apache Commons BeanUtils] are called
|
|
* BeanUtils.setProperty(...) or BeanUtilsBean.setProperty(...) from http://commons.apache.org/proper/commons-beanutils/[Apache Commons BeanUtils] are called
|
|
* org.springframework.beans.BeanWrapper.setPropertyValue(...) or org.springframework.beans.BeanWrapper.setPropertyValues(...) from Spring is called
|
|
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* the new property values might have been tampered with or provided by an untrusted source.
|
|
* sensitive properties can be modified, for example: ``++class.classLoader++``
|
|
|
|
There is a risk if you answered yes to any of those questions.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
Sanitize all values used as JavaBean properties.
|
|
|
|
|
|
Don't set any sensitive properties. Keep full control over which properties are set. If the property names are provided by an unstrusted source, filter them with a whitelist.
|
|
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
Company bean = new Company();
|
|
HashMap map = new HashMap();
|
|
Enumeration names = request.getParameterNames();
|
|
while (names.hasMoreElements()) {
|
|
String name = (String) names.nextElement();
|
|
map.put(name, request.getParameterValues(name));
|
|
}
|
|
BeanUtils.populate(bean, map); // Sensitive: "map" is populated with data coming from user input, here "request.getParameterNames()"
|
|
----
|
|
|
|
== See
|
|
|
|
* OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
|
|
* OWASP - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/[Top 10 2021 Category A8 - Software and Data Integrity Failures]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
|
|
* CWE - https://cwe.mitre.org/data/definitions/915[CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes]
|
|
* https://wiki.sei.cmu.edu/confluence/x/hDdGBQ[CERT, MSC61-J.] - Do not use insecure or weak cryptographic algorithms
|
|
* Derived from FindSecBugs rule https://find-sec-bugs.github.io/bugs.htm#BEAN_PROPERTY_INJECTION[BEAN_PROPERTY_INJECTION]
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Make sure that setting JavaBean properties is safe here.
|
|
|
|
|
|
=== Highlighting
|
|
|
|
First: the potentially corrupted data going to be populated in the JavaBean
|
|
|
|
Second: the method populating the JavaBean
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 15 Mar 2018, 16:15:19 Alexandre Gigleux wrote:
|
|
Reference: \https://stackoverflow.com/questions/23464487/classloader-vulnerability-reproducing-procedure-in-struts-1-1
|
|
|
|
endif::env-github,rspecator-view[]
|