CWE-93 对CRLF序列的转义处理不恰当（CRLF注入）
Improper Neutralization of CRLF Sequences ('CRLF Injection')
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 74 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 74 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: CanPrecede cwe_CWE_ID: 117 cwe_View_ID: 1000
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Integrity | Modify Application Data |
可能的缓解方案
Implementation
策略:
Avoid using CRLF as a special sequence.
Implementation
策略:
Appropriately filter or quote CRLF sequences in user-controlled input.
示例代码
例
If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.
bad Java
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2002-1771 | CRLF injection enables spam proxy (add mail headers) using email address or name. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1771 |
| CVE-2002-1783 | CRLF injection in API function arguments modify headers for outgoing requests. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1783 |
| CVE-2004-1513 | Spoofed entries in web server log file via carriage returns | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1513 |
| CVE-2006-4624 | Chain: inject fake log entries with fake timestamps using CRLF injection | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4624 |
| CVE-2005-1951 | Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1951 |
| CVE-2004-1687 | Chain: HTTP response splitting via CRLF in parameter related to URL. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1687 |
Notes
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | CRLF Injection | ||
| OWASP Top Ten 2007 | A2 | CWE More Specific | Injection Flaws |
| WASC | 24 | HTTP Request Splitting | |
| Software Fault Patterns | SFP24 | Tainted input to command |
相关攻击模式
- CAPEC-15
- CAPEC-81
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论