Skip to main content

Lack of data validation - Input Length

Description

Endpoints allow more content to be added to the body than is usually allowed by the endpoint, thus making it possible to send massive amounts of characters and expand attack vectors.

Impact

Send massive information in the request body.

Recommendation

Validate on the server side that user entries comply with a character limit.

Threat

Authorized attacker from the Internet.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: N
  • Availability: L

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 5.3
    • Temporal: 5.3
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The application uses user input after validating its length

function DOMCreation(request *http.Request) {
userOutput = validateLength(request.content);
const para = document.createElement("p");
para.innerText = userOutput;
document.body.appendChild(para);
}

Non compliant code

The application uses user input without server side validation

function ErroneousDOMCreation(request *http.Request) {
element = document.createElement(request.content);
document.body.appendChild(element);
}

Requirements