HTTP参数污染攻击

Question

我开发了一个web应用程序并部署到服务器中，我的安全团队提出了下面的安全需求问题。

反射(HPP)是一个注入弱点漏洞，攻击者可以插入分隔符并更改应用程序生成的参数。攻击的后果取决于应用程序的功能，但可能包括访问和潜在地利用不可控制的变量，进行其他攻击，如跨站点请求伪造，或以意外的方式更改应用程序行为。建议包括使用严格的验证输入来确保服务器正确处理编码参数分隔符“%26”，以及每当用户提供的内容包含在应用程序生成的链接或其他形式的输出中时使用URL编码。

有谁能想到如何防止asp.net中的HTML参数污染？

以下是网页中的脚本代码

<script type="text/javascript" language="javascript">

        document.onclick = doNavigationCheck ;  
        var srNumberFinal="";

        function OpenDetailsWindow(srNumber)
        {    
            window.open("xxx.aspx?SRNumber="+srNumber+ "","","minimize=no,maximize=no,scrollbars=yes,status=no,toolbar=no,menubar=no,location=no,width=800,directories=no,resizable=yes,titlebar=no");
        }

        function OpenPrintWindow()
        {
            var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

            if(querystrActivityId != "")
            {
                var url = "abc.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + querystrActivityId + "";
            }
            else
            {

                var hdrActivityId = document.getElementById('<%=uxHdnHdrActivityId.ClientID%>').value;
                var url = "PrintServiceRequestDetail.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + hdrActivityId + "";
            }

            childWinReference=window.open(url, "ChildWin","minimize=yes,maximize=yes,scrollbars=yes,status=yes,toolbar=no,menubar=yes,location=no,directories=no,resizable=yes,copyhistory=no");
            childWinReference.focus();
        }

        function NavigateSRCopy(srNumber)
        {    
            srNumberFinal = srNumber;

            if (srNumber != "undefined" && srNumber != null && srNumber != "")
            {
                new Ajax.Request('<%= (Request.ApplicationPath != "/") ? Request.ApplicationPath : string.Empty %>/xxx/AutoCompleteService.asmx/CheckFormID'
                                        , { method: 'post', postBody: 'srNumber=' + srNumber, onComplete: SearchResponse });
            }
        }

        function SearchResponse(xmlResponse)
        {
            var xmlDoc;

            try //Internet Explorer
            {
                xmlDoc=new ActiveXObject("Microsoft.XMLDOM");
                xmlDoc.async="false";
                xmlDoc.loadXML(xmlResponse.responseText);
            }  
            catch(e)
            {
                try // Firefox, Mozilla, Opera, etc.
                {
                    parser=new DOMParser();
                    xmlDoc=parser.parseFromString(xmlResponse.responseText,"text/xml");
                }
                catch(e)
                {
                    alert(e.message);   
                    return;
                }
            }

            if(xmlDoc.getElementsByTagName("string")[0].childNodes[0] != null)
            {
                formID = xmlDoc.getElementsByTagName("string")[0].childNodes[0].nodeValue; 
            }
            else
            {
                formID = null;
            }

            if(formID != null && formID != "")
            {          
                window.location.href = '/CustomerSupportRequest/CreateServiceRequest.aspx?id=' + formID + '&TemplateSR=' + srNumberFinal + '&Frompage=CopySR';

                return true;
            }
            else
            {    
                alert("This Service Request cannot be copied because it meets at least one of these conditions: \t\t\n\n        * It was created prior to 10/15/2008 \n        * It was auto generated as part of the Report Requeue Process \n        * It was auto generated as part of the ERA Requeue Process \n        * It was not created online");
            }
        }

        function UpdateChildCases()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.show(); 
        }

        function HideParentChildPopup()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.hide(); 
            return false;
        }

        function HideErrorSRNumsPopup()
        {
            var modalPopup = $find('modalParentErrorSRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function HideRetrySRNumsPopup()
        {
            var modalPopup = $find('modalRetrySRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function RemoveParent_ChildFlag(type)
        {
            var childCases = document.getElementById("<%=uxHdnChildCases.ClientID %>");
            var msg = "";
            var btn;

            if(type == "Child")
            {
                if(childCases.value.indexOf(',') != -1)
                    msg = "Are you sure you want to remove the Child flag from this Service Request?";
                else   
                    msg = "This is the only child associated to the parent case.  Removing the child flag will also remove the parent flag from the associated case.  Choose OK to remove the flags, or Cancel to close this dialog";

                btn = document.getElementById('<%=uxRemoveChildFlag.ClientID%>');
            }   
            else
            {
                msg = "Removing the parent flag from this case will also remove the child flag from all associated cases.  Are you sure you want to remove the Parent flag from this Service Request?";
                btn = document.getElementById('<%=uxRemoveParentFlag.ClientID%>');
            }

            if(btn)
            {
                if(!confirm(msg))
                {
                    return false;   
                }
                else
                {
                    btn.click();
                }
            } 
        }

        function limitTextForParentChildComments() 
        {   
            var objLblCharCount = document.getElementById('uxLblPCCharCount');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if (objTxtComments.value.length > 1500) 
            {
                objTxtComments.value = objTxtComments.value.substring(0, 1500);
            } 
            else 
            {
                objLblCharCount.innerHTML = 1500 - objTxtComments.value.length + " ";
            }

            setTimeout("limitTextForParentChildComments()",50);
        }

        function ValidateInputs()
        {
            var lblErrorMessage = document.getElementById('<%=lblCommentErrorTxt.ClientID%>');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if(objTxtComments.value.trim() == "")
            {
                lblErrorMessage.style.display = "block";
                return false;
            }
        }

    </script>

Answer 1

根据HTTP参数污染的OWASP测试，ASP.NET不容易受到HPP的攻击，因为ASP.NET将返回所有与逗号连接的查询字符串值(例如，color=red&color=blue给出color=red,blue)。

有关示例说明，请参见这里。

尽管如此，您的代码似乎容易受到XSS的攻击：

var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

如果查询字符串参数activityId="; alert('xss');" (当然是编码的URL)，那么警告框将在应用程序上触发，因为这段代码将在脚本标记中生成。

var querystrActivityId = ""; alert('xss');"";