CWE-1289

入力における安全でない等価性の不適切な検証

Improper Validation of Unsafe Equivalence in Input

脆弱性作成中

日本語説明

製品は、リソース識別子または他のタイプの参照として使用される入力値を受け取るが、その入力が潜在的に安全でない値と等価であることを検証しないか、誤って検証する。

攻撃者は、一見安全な入力であっても、下層や下流のコンポーネントで処理されると危険な入力を見つけることで、入力検証スキームを迂回することがあります。例えば、単純なXSS防御機構は、大文字と小文字を区別するマッチングを使って、入力に"<script>"タグがないことを検証しようとするかもしれません。しかし、ウェブブラウザで処理されるとき、HTMLは大文字と小文字を区別しないので、攻撃者は"<ScrIpT>"を注入してXSSを引き起こすことができます。

原文 (English)

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no "<script>" tags using case-sensitive matching, but since HTML is case-insensitive when processed by web browsers, an attacker could inject "<ScrIpT>" and trigger XSS.

関連する脆弱性

想定される影響

Scope: Other / Impact: Varies by Context

対策・緩和策

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

外部リンク

MITRE公式ページ — CWE-1289