Data Validation & Encoding (VE7)
Jan can craft special payloads to foil input validation because the character set is not specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed
Without strict character-set enforcement, canonicalization, and strong typing, attackers can craft ambiguously encoded payloads that evade input validation and tamper with the application.
Scenario: Jan's Crafty Payloads
Envision a situation where Jan, an astute intruder, manages to craft special payloads that circumvent input validation measures. He exploits several key weaknesses in the system:
- Unspecified/Unenforced Character Set: The system fails to define or enforce a consistent character set for inputs.
- Multiple Encodings: Data is encoded more than once, creating complexities that obscure malicious content.
- Inadequate Data Conversion (Canonicalization): Data isn't fully converted into the format the application uses before being validated.
- Weak Typing of Variables: Variables in the system are not strongly typed, allowing for type mismatches that can be exploited.
Example
Jan targets the system by submitting a payload with characters that change meaning based on the character set. For instance, he uses a character set where certain symbols are interpreted differently, bypassing filters that would otherwise block malicious inputs. Due to the system not strictly enforcing a character set, or fully converting data into a consistent format, his payload is processed without proper validation, leading to potential security breaches.
Threat Modeling
STRIDE
This scenario falls into the Tampering category of STRIDE. Crafting special/ambiguously encoded payloads to foil validation is an attack on the integrity of input data (i.e., tampering). Jan is modifying the data semantics (by using alternate encodings, double-encoding, differing charset interpretations, etc.) so that filters/validators no longer recognize the malicious content. STRIDE’s Tampering covers unauthorized modification or manipulation of data or how data is interpreted, which is exactly what character-set/canonicalization tricks do.
What can go wrong?
These vulnerabilities can result in severe security issues, such as injection attacks, data corruption, and unauthorized system access.
Without knowing the character encoding accurately, data validation routines could be inadequate. A web application firewall, a web server, an application server, a database server, and other interpreters could each be susceptible, and susceptible in different ways, to malicious character encoding issues.
For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.
What are we going to do about it?
- Use system components that support UTF-8 extended character sets. Specify proper character sets, such as UTF-8, for all sources of input.
- Prevent complications from multiple encodings by standardizing the encoding process.
- Ensure complete data conversion into the application’s format (canonicalization) before validation.
- Use strong typing for variables to prevent type-related security loopholes.
For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.
Mappings
OWASP ASVS (v5.0): 1.1.1,1.1.2,1.2.1,1.2.2,1.2.3,1.2.9,1.2.10,2.1.1,2.2.1,3.2.2,3.2.3,4.1.1,5.4.2,15.3.5,15.3.6,16.5.1
OWASP DevGuide: SSV3,SSV4,SSV5,VSD2,DP7
STRIDE: Tampering
CAPEC™: 3,4,28,43,52,64,71,72,78,79,80,120,126,152,153,267
CAPEC Map
| Code | Title | ASVS |
|---|---|---|
| 3 | Using Leading 'Ghost' Character Sequences to Bypass Input Filters | 1.1.1,1.2.9,1.2.10,2.1.1,2.2.1 |
| 4 | Using Alternative IP Address Encodings | 1.2.9,2.1.1,2.2.1 |
| 28 | Fuzzing | 1.1.1,1.2.1,1.2.2,1.2.3,1.2.9,1.2.10,2.1.1,2.2.1,3.2.2,5.4.2,15.3.5,15.3.6,16.5.1 |
| 43 | Exploiting Multiple Input Interpretation Layers | 1.1.1,1.2.1,1.2.2,1.2.3,1.2.9,1.2.10,1.1.2,2.1.1,2.2.1,3.2.2,4.1.1,5.4.2,16.5.1 |
| 52 | Embedding NULL Bytes | 1.2.10,2.1.1,2.2.1,5.4.2 |
| 64 | Using Slashes and URL Encoding Combined to Bypass Validation Logic | 1.1.1,1.2.2,1.2.9,2.1.1,2.2.1 |
| 71 | Using Unicode Encoding to Bypass Validation Logic | 1.1.1,1.1.2,1.2.9,2.1.1,2.2.1 |
| 72 | URL Encoding | 1.1.1,1.1.2,1.2.2,1.2.9,2.1.1,2.2.1 |
| 78 | Using Escaped Slashes in Alternate Encoding | 1.1.1,1.1.2,1.2.9,2.1.1,2.2.1 |
| 79 | Using Slashes in Alternate Encoding | 1.1.1,1.1.2,1.2.9,2.1.1,2.2.1 |
| 80 | Using UTF-8 Encoding to Bypass Validation Logic | 1.1.1,1.1.2,1.2.9,2.1.1,2.2.1 |
| 120 | Double Encoding | 1.1.1,1.1.2,1.2.9,2.1.1,2.2.1 |
| 126 | Path Traversal | 1.1.1 |
| 152 | Inject Unexpected Items | 1.2.9,2.1.1,2.2.1,15.3.5,15.3.6,16.5.1 |
| 153 | Input Data Manipulation | 1.2.9,2.1.1,2.2.1,15.3.5,15.3.6,16.5.1 |
