the-web-application-hackers-handbook

390 Chapter 10 n Attacking Back-End Components
Preventing SOAP Injection
You can prevent SOAP injection by employing boundary validation filters at any
point where user-supplied data is inserted into a SOAP message (see Chapter
2). This should be performed both on data that has been immediately received
from the user in the current request and on any data that has been persisted from
earlier requests or generated from other processing that takes user data as input.
To prevent the attacks described, the application should HTML-encode any
XML metacharacters appearing in user input. HTML encoding involves replacing
literal characters with their corresponding HTML entities. This ensures that the
XML interpreter treats them as part of the data value of the relevant element and
not as part of the structure of the message itself. Here are the HTML encodings
of some common problematic characters:
n < — &lt;
n > — &gt;
n / — &#47;
Injecting into Back-end HTTP Requests
The preceding section described how some applications incorporate user-supplied
data into back-end SOAP requests to services that are not directly accessible
to the user. More generally, applications may embed user input in any kind of
back-end HTTP request, including those that transmit parameters as regular
name/value pairs. This kind of behavior is often vulnerable to attack, since the
application often effectively proxies the URL or parameters supplied by the user.
Attacks against this functionality can be divided into the following categories:
n Server-side HTTP redirection attacks allow an attacker to specify an arbitrary
resource or URL that is then requested by the front-end application server.
n HTTP parameter injection (HPI) attacks allow an attacker to inject arbitrary
parameters into a back-end HTTP request made by the application
server. If an attacker injects a parameter that already exists in the back-end
request, HTTP parameter pollution (HPP) attacks can be used to override
the original parameter value specified by the server.
Server-side HTTP Redirection
Server-side redirection vulnerabilities arise when an application takes usercontrollable
input and incorporates it into a URL that it retrieves using a backend
HTTP request. The user-supplied input may comprise the entire URL that
is retrieved, or the application may perform some processing on it, such as
adding a standard suffix.