Fix Unicode Transformation Issue / Vulnerability in ColdFusion

Question

We recently updated our security scanner and are reporting a new issue.

What is the recommended fix? (We are in ACF9.)

(Also, if you have a CF-oriented usage example, I would appreciate it.)

---

Unicode Conversion Issues

Seriousness

High

A type

Configuration

Reported by the module

Scripting (XSS.script)

Description

This page is vulnerable to various Unicode conversion problems such as best match, alternating byte sequences, invalid sequences.

Best matches are displayed when an X character is converted to a completely different Y character. In general, best matches occur when characters are transcoded between Unicode and another encoding.

Overloaded Byte Sequences (Not the Shortest Form) - UTF-8 allows for various character representations, which also have a shorter form. For security reasons, the UTF-8 decoder should not receive UTF-8s that are larger than necessary for character encoding. For example, the character U + 000A (feed line) should be received from the UTF-8 stream only in the form 0x0A, but not in any of the following five possible overlaps of the form:

• 0xC0 0x8A

• 0xE0 0x80 0x8A

• 0xF0 0x80 0x80 0x8A

• 0xF8 0x80 0x80 0x80 0x8A

• 0xFC 0x80 0x80 0x80 0x80 0x8A

Unprepared subsequences, UNICODE REQUIRED 3.0, are noted in Unicode Technical Report No. 36, if the leading byte is followed by an invalid successor byte, then it should NOT consume it.

Influence

Software vulnerabilities arise when displaying Best-Fit. For example, characters can be manipulated to bypass string processing filters, such as cross-site scripting (XSS) or SQL Injection, WAF, and IDS filters. Overlung sequences of UTF-8 could abuse the bypass of UTF-8 substrings, which look only for the shortest encoding.

Recommendation

Identify the source of these Unicode conversion problems and fix them. See the web links below for more information.

Recommendations

Unicode Security

UTF-8 and Unicode FAQ for Unix / Linux

A few unicode issues in PHP and Firefox

Unicode Security Issues

Affecteditems

/ MySite-portal /

More details

The POST URL URL link was set to acu5955% EF% BC% 9Cs1% EF% B9% A5s2% CA% BAs3% CA% B9uca5955

The list of problems:

• Unicode character U + 02B9 PRIME MODIFICATION LETTER (encoded as% CA% B9) has been converted to U + 0027 APOSTROPHE (')

• Unicode character U + 02B9 PRIME MODIFICATION LETTER (encoded as% CA% B9) was transf ... (line truncated)

Request Headers

Get

?

/ MySite portal / display = Login & status = failed & RememberMe = 0 & ContentID = & LinkServID = acu5955% 1 Cs1es2% BAs3% B9uca5955 & returnURL = https://stage-cms.mysite.com/mysite-portal/ HTTP / 1.1 Referer: https : //stage-cms.mysite.com-00-0043/

Connection: Keep-alive

Accept-Encoding: gzip, deflate

User-Agent: Mozilla / 5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident / 5.0)

To accept: */*

Host: stage-cms.mysite.com

Answer 1

Answer: Canonicalization.

https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode#How_to_protect_yourself

How to protect yourself

A suitable canonical form must be selected, and all user input is canonized into this form before any permissions are accepted. Security checks should be performed after decoding UTF-8 is completed. It is also recommended that you verify that UTF-8 encoding is a valid canonical encoding for the character it represents.

http://www.mattgifford.co.uk/canonicalize-method-in-coldfusion-8-and-coldfusion-9

Answer 2

Canonicalization will not help you if your user inputs are an unordered sequence .

For more information on how to handle incorrect subsequences, see "Conversion Process Limitations" in Section 3.9, Unicode Encoding Encodings in Unicode 5.2

In these cases, replace invalid sequences with the "replace char" U+FFFD created specifically for this purpose. What a magic tablet that will work in 99.9% of cases, but it remains at 0.1%, enough to destroy your databases.

To be truly secure, you need to fully analyze your input parsers to make sure they are vulnerable to replacing U+FFFD .

The best solution that works all the time is to stop parsing, clean your garbage, and return an error message.

Answer 3

There are various solutions for this.

For CF 8 and 9 users:

Many features to work on this can be found at:

https://github.com/coldfumonkeh/cfml-security

For CF 10 users:

 canonicalize(inputString, restrictMultiple, restrictMixed) 

Hugs this problem. See http://help.adobe.com/en_US/ColdFusion/10.0/CFMLRef/WS932f2e4c7c04df8f-1a0d37871353e31b968-8000.html

For Railo users:

This was reviewed in 4.0.0.011

https://issues.jboss.org/browse/RAILO-1873?_sscc=t