input validation & injection

21 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Input validation failures as high-security events

A specific event for failures to validate a value against a discrete and finite list of valid values (e.g., a country from a dropdown) should be logged as a high security event because it can only be attack activity. For example, use event name format like `input_validation_fail[:field,userid]`.

Injection definition and scope

Injection flaws occur when an application sends untrusted data to an interpreter. Injection flaws are prevalent in legacy code and commonly found in SQL queries, LDAP queries, XPath queries, OS commands, and program arguments.

LDAP Injection definition

LDAP Injection is an attack used to exploit web-based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it is possible to modify LDAP statements through techniques similar to SQL Injection, resulting in granting of permissions to unauthorized queries and content modification inside the LDAP tree.

LDAP Injection escaping defense

LDAP distinguished names and LDAP search filters require different escaping rules as defined by RFC 4514 and RFC 4515 respectively. Avoid custom escaping code and use a library encoder for the correct context.

OS Command Injection definition

OS command injection is a technique used via a web interface to execute OS commands on a web server. The user supplies operating system commands through a web interface. Any web interface that is not properly sanitized is subject to this exploit. With the ability to execute OS commands, an attacker can upload malicious programs or obtain passwords.

OS Command Injection parameterization defense

If calling a system command with user-supplied input is unavoidable, use parameterization as the first layer of defense. Use structured mechanisms that automatically enforce separation between data and command, providing relevant quoting and encoding.

OS Command Injection input validation defense

Commands must be validated against a list of allowed commands. Arguments should be validated using positive or allowlist input validation or allow-list Regular Expression. Metacharacters like & | ; $ > < \ ! and whitespaces must not be allowed. Example regex allowing only lowercase letters and numbers, 3-10 characters: ^[a-z0-9]{3,10}$

Incorrect Java ProcessBuilder usage

ProcessBuilder b = new ProcessBuilder("C:\DoStuff.exe -arg1 -arg2"); In this example, the command together with arguments are passed as one string, making it easy to manipulate and inject malicious strings.

Correct Java ProcessBuilder usage

ProcessBuilder pb = new ProcessBuilder("TrustedCmd", "TrustedArg1", "TrustedArg2"); Map<String, String> env = pb.environment(); pb.directory(new File("TrustedDir")); Process p = pb.start(); The command and each argument are passed separately, making it easy to validate each term and reducing the risk to insert malicious strings.

Null Byte Injection attack vector

Null Byte Injection is an attack vector that occurs when scripting languages have flaws in data handling code. By injecting null bytes, attackers can gain access to other areas in memory, resulting in a successful attack.

OS Command Injection via URL parameter

Appending a semicolon to the end of a URL query parameter followed by an operating system command will execute the command. %3B is URL encoded and decodes to semicolon. Example: http://sensitive/something.php?dir=%3Bcat%20/etc/passwd The semicolon is interpreted as a command separator.

Injection Prevention Rule 1: Proper Input Validation

Perform proper input validation. Positive or allowlist input validation with appropriate canonicalization is recommended, but is not a complete defense as many applications require special characters in their input.

Injection Prevention Rule 2: Use Safe API

The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterized interface. Be careful of APIs such as stored procedures that are parameterized but can still introduce injection under the hood.

Injection Prevention Rule 3: Contextually Escape User Data

If a parameterized API is not available, carefully escape special characters using the specific escape syntax for that interpreter.

LDAP Injection attack factors

LDAP injection attacks are common due to two factors: the lack of safer parameterized LDAP query interfaces and the widespread use of LDAP to authenticate users to systems.

Request size limits by content type in Express

Set request size limits per content type to prevent DoS attacks via large request bodies. Use `app.use(express.urlencoded({ extended: true, limit: "1kb" }));` for URL-encoded data and `app.use(express.json({ limit: "1kb" }));` for JSON. JSON parsing is more dangerous than multipart parsing as it is a blocking operation. Note that attackers can change the `Content-Type` header to bypass limits, so validate the actual content type against the stated header before processing, especially for larger requests.

Input validation with URL parsing variability in Express

JavaScript is dynamic and Express may parse the same URL parameter into different data types. For example: `?foo=bar` becomes the string `'bar'`, `?foo=bar&foo=baz` becomes the array `['bar', 'baz']`, `?foo[bar]=baz` becomes an object `{ bar: 'baz' }`, and `?foo[toString]=bar` becomes an empty object `{}`. Always validate input against expected type and scheme because the application code may receive strings, arrays, objects, or nested structures from the same parameter name depending on query string syntax.

HTTP Parameter Pollution (HPP) prevention

HTTP Parameter Pollution occurs when attackers send multiple HTTP parameters with the same name. Express populates multiple parameter values into an array, causing unpredictable interpretation. Use the `hpp` module to ignore all but the last parameter value submitted: `app.use(hpp());`. This prevents HPP attacks.

Dangerous functions: eval() and child_process.exec()

Avoid the `eval()` function which executes strings as JavaScript code. Combined with user input, this causes remote code execution vulnerabilities. Avoid `child_process.exec()` which acts as a bash interpreter and sends arguments to /bin/sh. Injecting user input into this function allows arbitrary command execution. If these must be used, sanitize input carefully.

Dangerous modules requiring special care: fs, vm

The `fs` module handles filesystem operations. If improperly sanitized user input is fed to it, the application becomes vulnerable to file inclusion and directory traversal. The `vm` module provides APIs for compiling and running code in V8 Virtual Machine contexts. It should be used within a sandbox due to its dangerous nature. User input must be sanitized before use with these modules.

Regular Expression Denial of Service (ReDoS) prevention

ReDoS is a DoS attack that exploits regex implementations causing them to work extremely slowly on crafted input. Evil regexes typically combine grouping with repetition and alternation with overlapping. For example, `^(([a-z])+.)+[A-Z]([a-z])+$` can hang on long strings like `aaaa...aaaaAaaaaa...aaaa`. Use tools like `vuln-regex-detector` to identify vulnerable regex patterns.

Give your agent this brain