3 :Inyección
Injection se refiere a la posibilidad de que un atacante inyecte código malicioso o comandos en una aplicación, explotando así posibles debilidades en la gestión de entrada de datos.
Para prevenir este tipo de vulnerabilidades, es esencial validar y sanitizar adecuadamente todas las entradas de datos, utilizando parámetros de consulta parametrizados en consultas SQL, y evitando la construcción de comandos del sistema operativo basados en entradas no confiables.
Algunas de las inyecciones más comunes son:
SQL
NoSQL
Comando OS
Mapeo relacional de objetos (ORM)
LDAP y lenguaje de expresión (EL)
Inyección de biblioteca de navegación de gráficos de objetos (OGNL)
La revisión del código fuente es el mejor método para detectar si las aplicaciones son vulnerables a las inyecciones. Se puede realizar pruebas automatizadas de todos los parámetros, encabezados, URL, cookies, entradas de datos JSON, SOAP y XML.
Lista de Mapeados CWEs
CWE-20 Improper Input Validation
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-83 Improper Neutralization of Script in Attributes in a Web Page
CWE-87 Improper Neutralization of Alternate XSS Syntax
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-91 XML Injection (aka Blind XPath Injection)
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
CWE-100 Deprecated: Was catch-all for input validation issues
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CWE-116 Improper Encoding or Escaping of Output
CWE-138 Improper Neutralization of Special Elements
CWE-184 Incomplete List of Disallowed Inputs
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-471 Modification of Assumed-Immutable Data (MAID)
CWE-564 SQL Injection: Hibernate
CWE-610 Externally Controlled Reference to a Resource in Another Sphere
CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
Recursos
Última actualización