.NET Remediation Guidance for CWE-1174

Flaw type CWE-1174 flag locations in applications where there is insufficient input validation. This validation can occur in different technologies within .NET and we will go in to detail for each case. In general there are 3 cases: route attribute validation, model data annotations, and model validation.
 

MVC and WebAPI Controller Action Route Attributes

Why do you detect it?

Attackers may try to supply values that the target action did not originally intend to handle which may lead to unexpected behavior. Using route constraints helps ensure that the correct Action is invoked when a request is mapped to an Action and that the provided input matches what is expected for that action.

How does Veracode Static Engine detect flaws of this type?

In general Veracode Static Analysis finds this flaw as follows:
  1. The analysis searches your binaries for WebAPI Controller Actions.
  2. The analysis then checks if the Action Parameters are specified in the RouteAttribute with a Route Constraint.
  3. The analysis then checks that each Route Parameter has a Route Constraint or Custom Route Constraint, otherwise it will open a flaw.

How can I fix it and have the Veracode Static Engine automatically detect my fix?

This flaw can be remediated by ensuring that Route Constraints or Custom Route Constraints are specified.
For example, say we have the following Action:
[HttpGet]
[Route("/users/{userId}")]
public UserModel GetUser(Guid userId)
{
      // Returns a user's information by ID

It’s expected that the userId is a Guid type, however, this is not explicitly constrained in the configured route. To remediate the finding one could constrain userId in the route to a Guid type, like so:

[HttpGet]
[Route("/users/{userId:guid}")]
public UserModel GetUser(Guid userId)
{
      // Returns a user's information by ID

For more information and available constraints, see Microsoft’s documentation on Route Constraints: https://docs.microsoft.com/en-us/aspnet/web-api/overview/web-api-routing-and-actions/attribute-routing-in-web-api-2#route-constraints

MVC and WebAPI Model Data Annotations

Why do you detect it?

The Controller's Action has a model that fails to perform Model Validation due to a lack of Data Annotations on the Model. This could expose the application to other weaknesses related to insufficient input validation. If a value in a model is expected to conform to an expected format, then Data Annotations can be used to enforce those expectations.

How does Veracode Static Engine detect flaws of this type?

In general Veracode Static Analysis finds this flaw as follows:
  1. The analysis searches your binaries for WebAPI Controller Actions.
  2. The analysis then checks for models provided in the Actions.
  3. The analysis then checks each property in the model to see if it has a Data Annotation, if not it will open a flaw for that property.

How can I fix it and have the Veracode Static Engine automatically detect my fix?

Apply one of Microsoft’s Data Annotation attributes to the property to validate inputs. For example say we have the follow model:
public class UserModel
{
    public Guid Id { get; set; }

    public string Username { get; set; }

    public string Email { get; set; }
}

We could remediate this by using annotations on each of the properties, like so:

public class UserModel
{
  [Key]
    public Guid Id { get; set; }

  [RegularExpression("^[a-zA-Z-0-9]{3,16}$")]
    public string Username { get; set; }

  [EmailAddress]
    public string Email { get; set; }
}

MVC Model Validation

Why do you detect it?

The Controller's Action has a model that fails to perform Model Validation. This could expose the application to other weaknesses related to insufficient input validation. If a model is not validated, then the model may not conform to the expected inputs and could cause unexpected errors to occur later on in the application.

How does Veracode Static Engine detect flaws of this type?

In general Veracode Static Analysis finds this flaw as follows:
        1. The analysis searches your binaries for WebAPI Controller Actions.
        2. The analysis then checks for models provided in the Actions.
        3. The analysis then checks that ModelState.IsValid is called.

How can I fix it and have the Veracode Static Engine automatically detect my fix?

Perform the ModelState.IsValid check in the action before business logic. For example:
public void UpdateUser(UserModel user)
{
    if (!ModelState.IsValid)
    {
        // Do not continue. Model is not valid
    }           
        // Continue with business logic
}
 

How can I mitigate the risk?

It is always recommended to validate the model through the call to Model.IsValid check. However, there are instances in which the scanner is not able to validate that the control is present. This can occur when the Action is async. When an Action is async, it creates a state machine which is runtime dependent and cannot be verified statically. When using a mitigation, ensure that the before proceeding with business logic, the first check is to Model.IsValid. If it has been verified that Model.IsValid is performed before performing business logic, use a mitigation statement to document the control.

 

Topics (1)

Related Articles

Related Topics

    Ask the Community

    Get answers, share a use case, discuss your favorite features, or get input from the Community.