Skip to main content

Lack of data validation - Web Service

Description

The application does not control on the server side the data being sent in certain fields and allows the use of special characters, which leads to new attack vectors. In addition, there is no adequate control over the size of the fields that can be sent to the server.

Impact

  • Exhaust server resources in the file storage space.
  • Achieve XSS, SQLi or HTML injection to have a wider attack vector.

Recommendation

  • Validate on the server side, the types of data that are entered by using white lists, where a set of accepted characters is defined.
  • Validate the minimum and maximum length for the data entered by the user.

Threat

Anonymous attacker from intranet.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: A
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: L

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 5.4
    • Temporal: 5.4
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The application uses user input only after validating/sanitizing it

public void doPost( HttpServletRequest request, HttpServletResponse response){
try {
String fileReq = request.getParameter( "file" );
//Whitelist the input parameter against a verified string
if ( !whiteListExample.matcher( fileReq ).matches() ) {
throw new YourValidationException( "Improper file" );
}
// Code to process the file after it has been validated
} catch(YourValidationException e ) {
response.sendError(response.SC_BAD_REQUEST, e.getMessage());
}
}

Non compliant code

The application uses user input without server side validation

public void doPost( HttpServletRequest request, HttpServletResponse response){
try {
String fileReq = request.getParameter( "file" );
// Process file without validating
} catch(YourValidationException e ) {
response.sendError( response.SC_BAD_REQUEST, e.getMessage() );
}
}

Requirements