Skip navigation

 

Number 3 in the Top 10 most critical web application security vulnerabilitiesidentified by the Open Web Application Security Project (OWASP) is Malicious File Execution, which occurs when attacker's files are executed or processed by the web server. This can happen when an input filename is compromised or an uploaded file is improperly trusted.

Examples

  • file is accepted from the user without validating content
  • filename is accepted from the user
In the example below a file name is accepted from the user and appended to the server's filesystem path.
    
// get the absolute file path on the server's filesystem 
String dir = servlet.getServletContext().getRealPath("/ebanking")
// get input file name
String file = request.getParameter(“file”); 
// Create a new File instance from pathname string   
File f = new File((dir + "\\" + file).replaceAll("\\\\", "/")); 



If the filename was compromised to  ../../web.xml , it might allow access to web server properties

Malicious File Execution can result in:

  • files loaded from another server and executed within the context of the web server
  • modifying paths to gain access to directories on the web server
  • malicious scripts put into a directory with inadequate access controls

Protecting against Malicious File Execution

  • the Java EE Security Manager should be properly configured to not allow access to files outside the web root.
  • do not allow user input to influence the path name for server resources 
    • Inspect code containing a file open, include, create, delete...
  • firewall rules should prevent new outbound connections to external web sites or internally back to any other server. Or isolate the web server in a private subnet
  • Upload files to a destination outside of the web application directory. 
    • Enable virus scan on the destination directory.

Java specific Protecting against Malicious File Exection

Use the OWASP ESAPI  HTTPUtilities interface:

  • The ESAPI HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, responses, sessions, cookies, headers, and logging.

    The HTTPUtilities getSafeFileUploads method uses the Apache Commons FileUploader to parse the multipart HTTP request and extract any files therein
     
        
    public class HTTPUtilities 
    
        public void getSafeFileUploads(java.io.File tempDir,
                                   java.io.File finalDir)
                            throws ValidationException
    
    http://blogs.sun.com/carolmcdonald/resource/esapihttputil.jpg

References and More Information:
 




OWASP Top 10 number 2: Injection Flaws

Number 2 in the Top 10 most critical web application security vulnerabilitiesidentified by the Open Web Application Security Project (OWASP) is Injection Flaws. Injection happens whenever an attacker's data is able to modify a query or command sent to a database, LDAP server, operating system or other Interpreter. Types of injections are SQL, LDAP, XPath, XSLT, HTML, XML, OS command... SQL injection and Cross-Site Scripting account for more than 80% of the vulnerabilities being discovered against Web applications (SANS Top Cyber Security Risks).
 

SQL Injection Example

use of string concantenation to build query: SQL Injection can happen with dynamic database queries concatenated with user supplied input, for example with the following query:
   
    
 "select * from MYTABLE where name=" + parameter
if the user supplies "name' OR 'a'='a' " as the parameter it results in the following:
   
    
"select * from MYTABLE where name= 'name' OR 'a'='a';
the OR 'a'='a' causes the where clause to always be true which is the equivalent of the following:
   
    
"select * from MYTABLE;
if the user supplies "name' OR 'a'='a' ; delete from MYTABLE" as the parameter it results in the following:
   
    
"select * from MYTABLE where name= 'name' OR 'a'='a'; delete from MYTABLE;
the OR 'a'='a' causes the where clause to always be true which is the equivalent of the following:
   
    
"select * from MYTABLE; delete from MYTABLE;
some database servers, allow multiple SQL statements separated by semicolons to be executed at once.

SQL Injection can be used to:
 
  • create , read , update, or delete database data

Protecting against SQL Injection

  • Don't concatenate user input data to a query or command! 
    • Use Query Parameter binding with typed parameters, this ensures the input data can only be interpreted as the value for the intended parameter so the attacker can not change the intent of a query.
  • Validate all input data to the application using white list (what is allowed) for type, format, length, range, reject if invalid. (see previous blog entry)
  • don't provide too much information in error messages (like SQL Exception Information, table names..) to the user.

Java specific Protecting against SQL Injection

Don't concatenate user input data to a query or command:

  • Don't do this with JDBC:   
        
    String empId= req.getParameter("empId") // input parameter
    String query = "SELECT * FROM Employee WHERE
                         id = '" + empId +"'"?

  • Don't do this with JPA:  
        

    q = entityManager.createQuery(

Filter Blog

By date: