Red Hat Security Advisory: Red Hat Developer Hub 1.8.3 release

1. Implementation

   By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

2. Architecture and Design

   By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

3. Implementation · Input Validation

   When handling untrusted objects, validating using a schema can be used.

OWASP Cheat Sheets

• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V5.1.2 (opens in a new tab)

Attack patterns

• Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
• Exploiting Incorrectly Configured Access Control Security Levels (opens in a new tab)
• Manipulating User-Controlled Variables (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

3. Implementation · Input Validation

   Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

OWASP Cheat Sheets

• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.1 (opens in a new tab)

Attack patterns

• Path Traversal (opens in a new tab)
• Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
• Manipulating Web Input to File System Calls (opens in a new tab)
• Using Escaped Slashes in Alternate Encoding (opens in a new tab)
• Using Slashes in Alternate Encoding (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).