Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

1. Implementation

   By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

2. Architecture and Design

   By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

3. Implementation · Input Validation

   When handling untrusted objects, validating using a schema can be used.

OWASP Cheat Sheets

• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V5.1.2 (opens in a new tab)

Attack patterns

• Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
• Exploiting Incorrectly Configured Access Control Security Levels (opens in a new tab)
• Manipulating User-Controlled Variables (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   An application must make resources available to a client commensurate with the client's access level.

2. Architecture and Design

   An application must, at all times, keep track of allocated resources and meter their usage appropriately.

3. System Configuration

   Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Implementation · Architecture and Design

   Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.

3. Architecture and Design · Implementation · Attack Surface Reduction

   Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…

OWASP Cheat Sheets

• Cross Site Scripting Prevention (opens in a new tab)
• DOM based XSS Prevention (opens in a new tab)
• Injection Prevention (opens in a new tab)
• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)

OWASP ASVS 4.0.3

• V5.3.3 (opens in a new tab)
• V1.5.1 (opens in a new tab)

Attack patterns

• XSS Using MIME Type Mismatch (opens in a new tab)
• DOM-Based XSS (opens in a new tab)
• Reflected XSS (opens in a new tab)
• Stored XSS (opens in a new tab)
• Cross-Site Scripting (XSS) (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).