Improving Web Application Security: Threats and - CGISecurity

26 Part I: Introduction to Threats and CountermeasuresExample of Code Injection Through Buffer OverflowsAn attacker can exploit a buffer overflow vulnerability to inject code. With this attack,a malicious user exploits an unchecked buffer in a processby supplying a carefullyconstructed input value that overwrites the program’s stack and alters a function’sreturn address. This causes execution to jump to the attacker’s injected code.The attacker’s code usually ends up running under the process security context. Thisemphasizes the importance of using least privileged process accounts. If the currentthread is impersonating, the attacker’s code ends up running under the securitycontext defined by the thread impersonation token. The first thing an attacker usuallydoes is call the RevertToSelf API to revert to the process level security context thatthe attacker hopes has higher privileges.Make sure you validate input for type and length, especially before you callunmanaged code because unmanaged code is particularly susceptible to bufferoverflows.Cross-Site ScriptingAn XSS attack can cause arbitrary code to run in a user’s browser while the browseris connected to a trusted Web site. The attack targets your application’s users and notthe application itself, but it uses your application as the vehicle for the attack.Because the script code is downloaded by the browser from a trusted site, thebrowser has no way of knowing that the code is not legitimate. Internet Explorersecurity zones provide no defense. Since the attacker’s code has access to the cookiesassociated with the trusted site and are stored on the user’s local computer, a user’sauthentication cookies are typically the target of attack.Example of Cross-Site ScriptingTo initiate the attack, the attacker must convince the user to click on a carefullycrafted hyperlink, for example, by embedding a link in an email sent to the user or byadding a malicious link to a newsgroup posting. The link points to a vulnerable pagein your application that echoes the unvalidated input back to the browser in theHTML output stream. For example, consider the following two links.Here is a legitimate link:www.yourwebapplication.com/logon.aspx?username=bobHere is a malicious link:www.yourwebapplication.com/logon.aspx?username=alert('hackercode')