Network Security & Hardware - eWeek

Network Security & Hardware: Whodunit? Finding Security Vulnerabilities in Application Code


Application security has to start during the development process. That means fixing vulnerable code before applications are ever pushed out to the public. Much has been written about the secure software development lifecycle—now its time to test security pros and developers alike. Can you find the vulnerabilities in the code?

Sorry—there is no prize involved, just a minor brainteaser for those of you who design applications or are charged with assessing their security. The code on the slides was provided by Veracode and Qualys.
 
  • Whodunit? Finding Security Vulnerabilities in Application Code
    by Brian Prince
    code provided by Veracode and Qualys
  • File/Path Manipulation
    This occurs when the software allows user input to control or influence paths that are used in filesystem operations. This vulnerability could permit an attacker to access or change system files and other files critical to the application.
  • The Answer
    The code is vulnerable to file/path manipulation because of insufficient input validation (cwe 20) on the fn parameter, which leads to arbitrary file retrieval.
  • Hands Off the Database
    SQL injection is one of the most popular vectors of attack. When executed, the SQL statement fetches a different set of results from the database than the application would have originally requested. The attacker gains unauthorized access to or manipulates the data residing in the database on the server.
  • The Answer
    The code is vulnerable to SQL injection because it creates an ad-hoc query using the employeeID parameter, which is untrusted.
  • Solving Cross-site Scripting
    Cross-site scripting (XSS) remains one of the most common vulnerabilities affecting Web applications. If successful, an exploit could allow hackers to bypass access controls such as same origin policy.
  • The Answer
    In this case, moving the <title> to after the <meta> tag prevents XSS attacks that trick the browser into using UTF-7 to decode the payload when the page should be actually rendered as UTF-8.
xڽZ[s۸~~d_nw7ŗXbwIHB ,JVeSjy|8oi&4oAuB>K9lHbc.!KvfzC7o``ƛVYQ|v$UK*7-;RLDL1OwҨxLO^>.B࿎F:|=F#mX021q #yF.#An{R7Yh[((6j{A،LQLDruzH&$fvȿ+|>o~QLg\M<4#9 "L7'f*Ή{'_tt6g4Wln(3сױ1,?ۈnS3aܰ)M)vtZ4ܪwP臑WhNdm\)I;-<><:1)+Vʢ M&x9tKS:f:bLÃnF1>PC ';!{0#p\V5Ra5G\攪1O|؈{G{(a(;}eq+)P0nC-U̥zU\Ɋn'p` Ձ ^2R`-*T հq셜Þݙo&)?>d R_E!*aR= ׼>Iqv* .[1aCuTD,O4͌3Ky W&?׀c:sBrZ)ĺQĴdv-[9Ϛ 7s.9n ٝօrI/ ah~I%_zlgŎvjf]ffSO0[h>\ !I$STؖN ik'?aWyQq& XR?Ó,)uN~t@|@>c/1)rd|>s\MbSH;{$+}7icqD8 +9 (< ^0ZV {7VeLt"dY> "6#h9p\+ɻtqO@"f.[㑙CB0e_.Ն^ovﶍ#+𫄐Х$^Xr:= vA͘wsN%!JfI+knsqeQapS#Z7>g67c 3O#$vjڧDw% vӂֽWˆלWestOuO~)\9c.4ga-q a cp+)=jѤ:>*7p}SUA^8/VK@V ncFјfTT>g_Y#xO3+(XP.u1sgֽ]0? V|țjUxמo4g{l qEig`oiXI%k#׉x`+,B!S]OLmSgNVӪ2讞]BU:m-.U3g`GG*ar;LmTkqء9j[Xo2cQ JvV_ܔ&˼C]`I`z#p7PD'RMApuPy#y&յy8$Pc.kEb oDz j*cnW~#Z3H䈘 M؞(.D-bt7")th8ɗn &5 ;όF)xp98R.'2]([yw~ޑZuU )RX^c݆̪f;OY*@Λ5`(3<>яv&NXyB)@ SPpxdMADfTaz8ak`9 &*nZS4,PB qٓu"fˆI^KerDdTǪl or AmkB Cs.)(iͩu ?YdbPds[6d$ͺ4X9X؅$ wwv3]»C.0x` acmA4sǑg,Rm.!?^>qL玩&G \01cX{}=+rx>qekZFEbp\|rvP~|x{/: L"s}{zap'xtOO{Wp QXa,m7:~y3Ne`)7}x/\t| Zh3Ow?7mXΊF+c+Ѩ~=ŴYI2UeTF,7vZFSƼ ܟ.^: w%16:tq@N㭲P ƫJڄ>,