Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8 for Spring Boot security update

1. Requirements

   Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

2. Architecture and Design

   Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

3. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V8.1.4 (opens in a new tab)
• V13.4.1 (opens in a new tab)
• V11.1.4 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Exponential Data Expansion (opens in a new tab)
• Serialized Data Parameter Blowup (opens in a new tab)
• Serialized Data with Nested Payloads (opens in a new tab)
• Oversized Serialized Data Payloads (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

Attack patterns

• Forced Deadlock (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place.

2. Architecture and Design

   Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or; uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

3. Architecture and Design

   Ensure that protocols have specific limits of scale placed on them.

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Regular Expression Exponential Blowup (opens in a new tab)
• Sustained Client Engagement (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

2. System Configuration

   Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

3. Implementation

   Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

Attack patterns

• Regular Expression Exponential Blowup (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt".

2. Architecture and Design · Operation

   Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory.

3. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)
• Secure Design Principles (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.2 (opens in a new tab)
• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)

Attack patterns

• Subverting Environment Variable Values (opens in a new tab)
• Leverage Alternate Encoding (opens in a new tab)
• Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
• URL Encoding (opens in a new tab)
• Manipulating Web Input to File System Calls (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

3. Implementation · Input Validation

   Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

OWASP Cheat Sheets

• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.1 (opens in a new tab)

Attack patterns

• Path Traversal (opens in a new tab)
• Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
• Manipulating Web Input to File System Calls (opens in a new tab)
• Using Escaped Slashes in Alternate Encoding (opens in a new tab)
• Using Slashes in Alternate Encoding (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).