Functional Functions C #

Question

This question is similar to PHP Operated Functions .

Thin data comes from the user or, more specifically, the attacker. When an infected variable reaches the receiver function, you have a vulnerability. For example, the function that executes the sql query is the receiver, and the GET / POST variables are the sources of taint.

What are all sink functions in C #? I am looking for features that cause software vulnerabilities or weaknesses . I am particularly interested in remote code vulnerabilities. Are there whole classes / libraries that contain unpleasantly functional things that a hacker would like to influence? How do people accidentally make dangerous C # code?

Answer 1

On the web side of things, C # (and, more generally, ASP.NET) is usually vulnerable to the following elements (elements listed by OWASP Top 10 2013 ). I understand that you are mostly interested in the shell functions, of which I cover some, however you did ask how people accidentally create dangerous C # code, so I hope I have provided some insight here.

A1-injection

SQL injection

Query generation by concatenating strings.

var sql = "SELECT * FROM UserAccount WHERE Username = '" + username "'"; SqlCommand command = new SqlCommand(sql , connection); SqlDataReader reader = command.ExecuteReader(); 

This can often be solved with parameterized queries , but if you use the IN clause, this is currently not possible without string concatenation.

LDAP Injection

Code for example

 searcher.Filter = string.Format("(sAMAccountName={1})", loginName); 

may make the application vulnerable. More details here .

OS Command Injection

This code is vulnerable to entering commands, because the second parameter Process.Start may have additional commands passed to it using the & symbol to batch process several commands

 string strCmdText= @"/C dir c:\files\" + Request.QueryString["dir"]; ProcessStartInfo info = new ProcessStartInfo("CMD.exe", strCmdText); Process.Start(info); 

eg. foldername && ipconfig

A2-Broken Authentication and Session Management

Log off

By default, the SignOut authentication method does not update the server side, allowing you to continue using the captured autostart.

Calling the SignOut method only removes the forms authentication cookie. The web server does not save valid and expired authentication tickets for later comparison. This makes your site vulnerable to re-attack if an attacker receives a valid authentication cookie.

Using Session State for Authentication

A session commit might be vulnerable if the user used session state for authentication .

Scripts A3-Cross-Site (XSS)

Response.Write (and the label <%= => ) are vulnerable by default if the developer does not remember the HTML encoding of the output. A later label <%: HTML is encoded by default, although some developers can use it to insert values ​​in JavaScript, where an attacker can avoid this. Even using the modern Razor engine , it is difficult to do it right:

 var name = '@Html.Raw(HttpUtility.JavaScriptStringEncode(Model.Name))'; 

ASP.NET by default includes Request Validation , which blocks any input from cookies, query strings, and POST data that could potentially be malicious (like HTML tags). This seems to do well with input coming through a particular application, but if the database has content that has been added from other sources, for example, from an application written using other technologies, it is possible that the malicious script code may still be deduced. Another weakness is that the data is inserted inside the attribute value. eg.

 <% alt = Request.QueryString["alt"]; %> <img src="http://example.com/foo.jpg" alt="<%=alt %>" /> 

This can be used without running a query check:

If alt -

 " onload="alert('xss') 

then it does

 <img src="http://example.com/foo.jpg" alt="" onload="alert('xss')" /> 

In older versions of .NET, this was a bit of a mine-field for the developer to ensure that their output was correctly encoded using some default web controls.

Unfortunately, the data binding syntax does not yet contain a built-in encoding syntax; its appearance in the next version of ASP.NET

eg. not vulnerable:

  <asp:Repeater ID="Repeater1" runat="server"> <ItemTemplate> <asp:TextBox ID="txtYourField" Text='<%# Bind("YourField") %>' runat="server"></asp:TextBox> </ItemTemplate> </asp:Repeater> 

vulnerable:

 <asp:Repeater ID="Repeater2" runat="server"> <ItemTemplate> <%# Eval("YourField") %> </ItemTemplate> </asp:Repeater> 

A4-Insecure Direct Object Links

Linking the MVC model may allow parameters added to the POST data to map to the data model. This may happen unintentionally, because the developer did not understand that an attacker could change the settings in this way. The Bind attribute can be used to prevent this .

Incorrect A5 configuration

There are many configuration options that can weaken application security. For example, set customErrors to On or enable tracing.

Scanners such as ASafaWeb can check for these common incorrect configurations.

A6-sensitive data exposure

Default Hashing

The default hashing methods in ASP.NET are sometimes not the best.

• HashPasswordForStoringInConfigFile () - this can also be bad if it is used to hash a simple password without adding salt.
• Article Our no-hash process doesn’t have a “regarding ASP.NET membership provider in .NET 4.

Access Control to Functional Level A7

URL restriction disclaimer

In integrated pipeline mode, .NET can see every request, and descriptors can resolve each request even for non-.NET resources (such as .js and images). However, if the application I am running in classic mode, .NET only sees requests for files, such as .aspx , so other files may be accidentally unsecured. See this answer for more details.

eg. www.example.com/images/private_photograph_user1.jpg is likely to be vulnerable in an application that runs in classic mode, although there are workarounds .

A8-Cross-Site Request Subroutine (CSRF)

Although legacy web form applications are generally more secure for CSRFs because an attacker must fake View State and Event Validation , newer MVC applications may be vulnerable if the developer did not manually execute anti-fake tokens . Note that I am not saying that web forms are not vulnerable, it’s just more difficult to simply pass a few basic parameters - there are corrections, although, for example, integration of the user key into the value of “View state”.

If the EnableEventValidation property is set to true, ASP.NET verifies that the control event originated from the user interface that was rendered by this control. The control registers its events during rendering, and then checks for events during postback or callback processing. For example, if the list control includes parameters numbered 1, 2, or 3, when the page is displayed, and if a return request is received that sets parameter 4, ASP.NET throws an exception. All event-driven controls in ASP.NET use this feature by default.

Function

[EnableEventValidation] reduces the risk of unauthorized or malicious callbacks and callbacks. It is highly recommended that you disable event checking.

A10-Unvalidated - Forwarding and Forwarding

Adding code, for example

 Response.Redirect(Request.QueryString["Url"]); 

will make your site vulnerable. An attack can be triggered by sending a phishing email to the user containing the link. If the user is vigilant, he can double check the domain URL before clicking. However, since the domain will correspond to your domain, which the user trusts, he clicks the link, not suspecting that the page will redirect the user to the domain of the attacker.

Verification should be done on Url to ensure that it is either a relative, allowed URL, or an absolute URL for one of your own allowed domains and pages. You can verify that someone is not redirecting your users to /Logout.aspx , for example. Although there could be nothing to prevent an attacker from directly linking to http://www.example.com/Logout.aspx , they could use redirection to hide the URL, so it’s more difficult for the user to figure out which page they are accessing ( http://www.example.com/Redirect.aspx?Url=%2f%4c%6f%67%6f%75%74%2e%61%73%70%78 ).

Other

Other categories of OWASP:

• A9 - Use of components with known vulnerabilities

about which I can’t think of anything, which is typical for C # / ASP.NET. I will update my answer if I think of any (if you think they are relevant to your question).

Answer 2

Everything that uses regular expressions (in particular, RegularExpressionValidator). To see this, run RegularExpressionValidator with the regular expression ^(\d+)+$ and give it 30 digits and an alpha character to test.

Some posts:

• http://msdn.microsoft.com/en-us/magazine/ff646973.aspx
• http://www.abemiester.com/abemiester/post/RegEx-DOS-attack-Regular-Expressions-Now-you-have-3-problems.aspx (this is a blog post from my own blog that goes into more detail about the MSDN article).

This is called a regular expression forced call attack, and it can bring the site to its knees.

Answer 3

Process.Start is the first thing that comes to mind.

I am sure that WindowsIdentity and most of System.Security can also be used for evil.

Of course, there are SQL injection attacks, but I don’t think what you mean (although remote execution can happen through SQL Server).

Answer 4

Besides the obvious Process.Start() , already mentioned, I see a couple of ways of potential indirect exploitation.

• WinAPI calls through PInvoke to CreateProcess() and something else.
• Any kind of dynamic assembly loading mechanism using Assembly.Load() and other similar overloads. If the compromised assembly went into the system and booted.
• If you fully trust.
• If you have access rights, any registry operations could put you at risk.

That’s all that comes to mind right now.

Answer 5

IMO: 1st functional functions that look innocent, but very dangerous when used without thought.

In ASP.Net Response.Write or shortcut:

  <%= searchTermFromUser %> 

In ADO.Net:

• The string + operator:
  var sql = "SELECT * FROM table WHERE name = '" + searchTermFromUser + "'"

Answer 6

Any piece of data that you receive from a user (or any other external source) and transferred to another system or another user is a potential exploit.

If you get a string from a user and display it to another user without using HtmlEncode, this is a potential exploit.

If you get a string from a user and use it to build SQL, this is a potential SQL injection.

If you get a string from a user and use it to compress the file name for Process.Start or Assembly.Load, this is a remote execution vulnerability

You understand that the danger is connected with the use of non-cleared data, if you never log in to an external system without cleaning it (for example, HtmlEncode) or using injection-safe interfaces (example: SQL parameters), you are relatively safe - at that moment, when you forget to sanitize that the most innocent method could become a security vulnerability.

Note: cookies, html headers and everything that passes over the network are also user data, in most cases even the data in your database is user data.

Answer 7

A lot of things in System.Net, System.XML, System.IO (everything that takes a URI and / or path to a file and actually deals with a resource that they identify) System.Reflection, System.Security, System. Web, System.Data, and System.Threading namespaces can be dangerous, as they can be used to create bad things that go further than just messing up the current execution. So much so that there would be a lot of time to try to identify them.

Of course, every method in all third-party builds should be considered dangerous until otherwise shown. Even more time.

And I do not think this is particularly fruitful. Creating a function checklist really only works with a limited library or with a large language, where much of what would be in a library with a language like C # is in the language itself.

There are some classically dangerous examples, such as Process.Start() or anything that directly executes another process, but they are balanced, being obviously dangerous. Even a relatively reckless and incompetent encoder can take care of when they use it, leaving data that relates to other methods unactivated.

This data sanitation is a more fruitful thing than any list of features. Is the data checked to remove obviously incorrect input (which may be due to an attack or it may just be an error) and is it encoded accordingly for a certain layer (too many conversations about “dangerous” sequences of characters, ' never harm anyone, he ' is not properly shielded for SQL, which can damage when it is really at the SQL level - the task necessary to ensure correct data entry is the same as to avoid exploits). Are layers on which communication with something outside the code is strong. For example, URIs are built using parsed input if you cannot include some of the most commonly used System.Net and System.XML methods in holes.

Answer 8

Using any type of insecure code can cause problems, such as pointers. Microsoft has provided a good article on unsafe code here: http://msdn.microsoft.com/en-us/library/aa288474(VS.71).aspx

Answer 9

Reflection.Emit and CodeDom

Edit :

The permissions of plugins or third-party libraries that use streams can lead your entire application if you do not load these libraries / plugins into a separate area of ​​the application.

Answer 10

Probably half the framework contains some very scary features. I myself think that File.WriteAllText() very scary, since it can overwrite any file that the current user has access to.

Another approach to this will be how you can manage security. The article http://ondotnet.com/pub/a/dotnet/2003/02/18/permissions.html contains a basic description of .NET security with System.Security.Permissions , which contains all .NET permissions. You can also look at http://msdn.microsoft.com/en-us/library/5ba4k1c5.aspx for more information.

In short, .NET allows you to limit the permissions that a process may have, for example, to prohibit methods that modify data on disk. You can then check these rights and act regardless of whether they have a process or not.

Answer 11

even a simple string comparison may occur.

If the application makes a trust decision based on the results of this String.Compare operation, the result of this decision can be changed by CurrentCulture

Take a look at an example . Pretty easy to miss

Answer 12

I saw code in which the user could set the name and parameters for calling the function in the database. Then, the system will execute the named function through Reflection without checking anything ...