Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

1. Implementation · Input Validation

   Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.

2. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

3. Implementation · Output Encoding

   While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)
• Server Side Request Forgery Prevention (opens in a new tab)
• Unvalidated Redirects and Forwards (opens in a new tab)
• Cross Site Scripting Prevention (opens in a new tab)

OWASP ASVS 4.0.3

• V1.5.1 (opens in a new tab)
• V5.2.2 (opens in a new tab)

Attack patterns

• Command Delimiters (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   If at all possible, use library calls rather than external processes to recreate the desired functionality.

2. Architecture and Design · Operation · Sandbox or Jail

   Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.

3. Architecture and Design · Attack Surface Reduction

   For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.

OWASP Cheat Sheets

• Injection Prevention (opens in a new tab)
• Injection Prevention in Java (opens in a new tab)
• OS Command Injection Defense (opens in a new tab)
• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.5 (opens in a new tab)
• V5.3.8 (opens in a new tab)
• V1.5.1 (opens in a new tab)

Attack patterns

• Command Line Execution through SQL Injection (opens in a new tab)
• Command Delimiters (opens in a new tab)
• Exploiting Multiple Input Interpretation Layers (opens in a new tab)
• Argument Injection (opens in a new tab)
• OS Command Injection (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

2. System Configuration

   Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

3. Implementation

   Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

Attack patterns

• Regular Expression Exponential Blowup (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.

2. Architecture and Design · Implementation

   If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

3. Implementation · Input Validation

   For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

OWASP Cheat Sheets

• Mass Assignment (opens in a new tab)
• Software Supply Chain Security (opens in a new tab)
• Infrastructure as Code (opens in a new tab)

OWASP ASVS 4.0.3

• V5.1.2 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

2. Architecture and Design

   Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

3. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V8.1.4 (opens in a new tab)
• V13.4.1 (opens in a new tab)
• V11.1.4 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Exponential Data Expansion (opens in a new tab)
• Serialized Data Parameter Blowup (opens in a new tab)
• Serialized Data with Nested Payloads (opens in a new tab)
• Oversized Serialized Data Payloads (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Operation

   If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation.

2. Implementation · Operation

   If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation.

3. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

OWASP Cheat Sheets

• Server Side Request Forgery Prevention (opens in a new tab)
• Unvalidated Redirects and Forwards (opens in a new tab)
• Cross Site Scripting Prevention (opens in a new tab)
• DOM based XSS Prevention (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V12.6.1 (opens in a new tab)
• V5.2.6 (opens in a new tab)

Attack patterns

• Server Side Request Forgery (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).