Red Hat Security Advisory: tomcat security update

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Implementation · Output Encoding

   Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8.

3. Implementation · Input Validation

   Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

OWASP ASVS 4.0.3

• V8.3.8 (opens in a new tab)
• V2.8.5 (opens in a new tab)
• V2.8.4 (opens in a new tab)

Attack patterns

• Using Leading 'Ghost' Character Sequences to Bypass Input Filters (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Attack Surface Reduction

   Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of…

2. Architecture and Design · Libraries or Frameworks

   Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

3. Architecture and Design · Implementation · Attack Surface Reduction

   Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any…

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)
• Injection Prevention (opens in a new tab)
• SQL Injection Prevention (opens in a new tab)
• Injection Prevention in Java (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

Attack patterns

• Buffer Overflow via Environment Variables (opens in a new tab)
• Server Side Include (SSI) Injection (opens in a new tab)
• Cross Zone Scripting (opens in a new tab)
• Command Line Execution through SQL Injection (opens in a new tab)
• Object Relational Mapping Injection (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place.

2. Architecture and Design

   Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or; uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

3. Architecture and Design

   Ensure that protocols have specific limits of scale placed on them.

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Regular Expression Exponential Blowup (opens in a new tab)
• Sustained Client Engagement (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Input Validation

   Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.

2. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

3. Implementation · Input Validation

   Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Invalidate any existing session identifiers prior to authorizing a new user session.

2. Architecture and Design

   For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value.

3. Operation · Firewall

   Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.

OWASP Cheat Sheets

• Session Management (opens in a new tab)
• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V3.2.1 (opens in a new tab)

Attack patterns

• Session Credential Falsification through Forging (opens in a new tab)
• Accessing/Intercepting/Modifying HTTP Cookies (opens in a new tab)
• Manipulating Opaque Client-based Data Tokens (opens in a new tab)
• Session Credential Falsification through Prediction (opens in a new tab)
• Reusing Session IDs (aka Session Replay) (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Developers should anticipate that escape, meta and control characters/sequences will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.

2. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

3. Implementation · Output Encoding

   While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)
• Server Side Request Forgery Prevention (opens in a new tab)
• Unvalidated Redirects and Forwards (opens in a new tab)
• Cross Site Scripting Prevention (opens in a new tab)

OWASP ASVS 4.0.3

• V1.5.1 (opens in a new tab)
• V5.2.2 (opens in a new tab)

Attack patterns

• Email Injection (opens in a new tab)
• Using Meta-characters in E-mail Headers to Inject Malicious Payloads (opens in a new tab)
• Web Server Logs Tampering (opens in a new tab)
• Log Injection-Tampering-Forging (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Implementation

   It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error…

3. Implementation

   Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].

Attack patterns

• TCP Fragmentation (opens in a new tab)
• UDP Fragmentation (opens in a new tab)
• ICMP Fragmentation (opens in a new tab)
• BlueSmacking (opens in a new tab)
• Flooding (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Use a web server that employs a strict HTTP parsing procedure, such as Apache.

2. Implementation

   Use only SSL communication.

3. Implementation

   Terminate the client session after each request.

OWASP Cheat Sheets

• REST Assessment (opens in a new tab)
• REST Security (opens in a new tab)
• Cross-Site Request Forgery Prevention (opens in a new tab)
• Secure Design Principles (opens in a new tab)

OWASP ASVS 4.0.3

• V13.2.5 (opens in a new tab)

Attack patterns

• HTTP Response Smuggling (opens in a new tab)
• HTTP Request Smuggling (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Architecture and Design

   Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.

3. Architecture and Design · Enforcement by Conversion

   When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

OWASP Cheat Sheets

• Mass Assignment (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V5.1.5 (opens in a new tab)

Attack patterns

• Cross-Site Flashing (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V2.8.5 (opens in a new tab)
• V2.8.4 (opens in a new tab)
• V9.2.3 (opens in a new tab)

Attack patterns

• Reflection Attack in Authentication Protocol (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Output Encoding

   Use context-aware encoding. That is, understand which encoding is being used by the downstream component, and ensure that this encoding is used. If an encoding can be specified, do so, instead of assuming that the default encoding is the same as the default being assumed by the downstream component.

2. Architecture and Design · Output Encoding

   Where possible, use communications protocols or data formats that provide strict boundaries between control and data. If this is not feasible, ensure that the protocols or formats allow the communicating components to explicitly state which encoding/decoding method is being used.

3. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

OWASP Cheat Sheets

• Content Security Policy (opens in a new tab)

OWASP ASVS 4.0.3

• V14.4.6 (opens in a new tab)
• V14.4.4 (opens in a new tab)
• V14.4.2 (opens in a new tab)

Attack patterns

• Generic Cross-Browser Cross-Domain Theft (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Operation · System Configuration

   Do not expose file and directory information to the user.

OWASP Cheat Sheets

• Error Handling (opens in a new tab)
• Logging (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V8.3.4 (opens in a new tab)
• V14.3.3 (opens in a new tab)
• V7.3.3 (opens in a new tab)

Attack patterns

• WSDL Scanning (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

2. Architecture and Design

   Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

3. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V8.1.4 (opens in a new tab)
• V13.4.1 (opens in a new tab)
• V11.1.4 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Exponential Data Expansion (opens in a new tab)
• Serialized Data Parameter Blowup (opens in a new tab)
• Serialized Data with Nested Payloads (opens in a new tab)
• Oversized Serialized Data Payloads (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

Attack patterns

• SQL Injection (opens in a new tab)
• NoSQL Injection (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.

2. Implementation

   Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere.

3. System Configuration

   Setup default error messages so that unexpected errors do not disclose sensitive information.

OWASP Cheat Sheets

• Error Handling (opens in a new tab)
• Logging (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V8.3.4 (opens in a new tab)
• V14.3.3 (opens in a new tab)
• V7.3.3 (opens in a new tab)

Attack patterns

• Choosing Message Identifier (opens in a new tab)
• Exploiting Incorrectly Configured SSL/TLS (opens in a new tab)
• WiFi MAC Address Tracking (opens in a new tab)
• WiFi SSID Tracking (opens in a new tab)
• Cellular Broadcast Message Request (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• Error Handling (opens in a new tab)
• Logging (opens in a new tab)

OWASP ASVS 4.0.3

• V8.3.4 (opens in a new tab)
• V14.3.3 (opens in a new tab)
• V7.3.3 (opens in a new tab)

Attack patterns

• Cross-Domain Search Timing (opens in a new tab)
• Application Fingerprinting (opens in a new tab)
• System Footprinting (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice.

OWASP ASVS 4.0.3

• V8.3.8 (opens in a new tab)
• V13.4.2 (opens in a new tab)
• V7.2.2 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Implementation · Architecture and Design

   Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.

3. Architecture and Design · Implementation · Attack Surface Reduction

   Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…

OWASP Cheat Sheets

• Cross Site Scripting Prevention (opens in a new tab)
• DOM based XSS Prevention (opens in a new tab)
• Injection Prevention (opens in a new tab)
• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)

OWASP ASVS 4.0.3

• V5.3.3 (opens in a new tab)
• V1.5.1 (opens in a new tab)

Attack patterns

• XSS Using MIME Type Mismatch (opens in a new tab)
• DOM-Based XSS (opens in a new tab)
• Reflected XSS (opens in a new tab)
• Stored XSS (opens in a new tab)
• Cross-Site Scripting (XSS) (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).