top 5 web application security bugs in custom code
DESCRIPTION
Top 5 Web Application Security bugs in custom code. Varun Sharma Security Engineer | ACE Team | Microsoft Information Security [email protected] . Top 5 Web App Security bugs. - PowerPoint PPT PresentationTRANSCRIPT
Top 5 Web Application Security bugs in custom code
Varun SharmaSecurity Engineer | ACE Team | Microsoft Information [email protected]
Top 5 Web App Security bugs
Relative percentage of the Top 5 Web Application Security vulnerabilities found by Microsoft ACE Team since 1st Jan 08
AgendaCross-Site ScriptingClear Text SecretsAuthorization Issues
Disabling Controls in the Web site to enforce authorizationDirect Object ReferenceMissing Authorization controls in web services
SQL Injection Verbose Error messages
Cross-Site Scripting
User controlled input is rendered back to browser without sufficient input validation or output encoding
Leads to execution of script (controlled by the attacker) under the context of the victim
Cross-Site Scripting
Common Buggy Code Some ASP.NET Controls encode and some do not
Cross-Site Scripting
Common Buggy Code Some ASP.NET Controls encode and some do not
Cross-Site Scripting
User input going in attribute context
User input going in JavaScript context
Cross-Site Scripting
CountermeasuresValidate all input and encode all outputPerform context specific encodingUse the AntiXss Library
Clear Text Secrets
The application may need to store credentials to connect to SQL Server, SMTP Server etc May need to store symmetric keys to perform encryption of application dataMay be storing user passwords or other secret information in the database
Clear Text Secrets
CountermeasuresDo not store secrets (passwords/ keys) in codeUse the aspnet_regiis tool to encrypt configuration settings For application specific data, consider using SQL Server 2005/ 2008 Native Encryption
Authorization IssuesDisabling Controls in the Web site to enforce authorization (Normal execution)
Authorization IssuesDisabling Controls in the Web site to enforce authorization (What attacker does)
Authorization IssuesDisabling HTML text boxes, buttons in only a visual indication, not a security controlNeed to perform explicit authorization checks on the server side
Authorization IssuesDirect Object Reference (What attacker does)
Authorization IssuesDirect Object Reference
Unique identifier is used to retrieve and update data for an object. This unique identifier is an incrementing integer (or easily available). No explicit authorization check is performed to ensure current user has access to the object.
Authorization IssuesMissing authorization in web services in multi- tier applications
Web Server SQL ServerWeb Server
(Website) (Web service) (Database)
Authorization IssuesCountermeasures:-
Perform server side authorizationUse a platform provided authorization mechanism
URL AuthorizationDeclarative and Imperative checks
Implement authorization controls in middle tiers
SQL InjectionUser input without sufficient validation is used to create and execute a dynamic SQL statementUser can manipulate the SQL statement that gets executed
SQL InjectionCountermeasures:-
Validate all inputUse parameterized SQL statements (in stored procedures as well, using sp_executesql)Configure SQL server with least privilege for defense in depth
Verbose Error messagesDetailed error messages reveal inner workings of an application and make an attackers job easier
Verbose Error messagesCommon Buggy Code:-
Missing exception handling in ASMX web services
ReferencesAntiXss Libraryhttp://www.microsoft.com/downloads/details.aspx?familyid=efb9c819-53ff-4f82-bfaf-e11625130c25&displaylang=en
ASP.NET IIS Registration Tool (Aspnet_regiis)http://msdn.microsoft.com/en-us/library/k6h9cz8h(VS.80).aspx
ASP.NET Authorizationhttp://msdn.microsoft.com/en-us/library/wce3kxhd(VS.80).aspx
Using sp_executesqlhttp://msdn.microsoft.com/en-us/library/ms175170.aspx
Feedback / QnAYour Feedback is Important!Please take a few moments to fill out our
online feedback form
Use the Question Manager on LiveMeeting to ask your questions now!
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after
the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.