Known Drupal Vulnerabilities and OWASP’s Top10

Prepared this talk for the Buenos Aires Drupal meetup

Transcript

2. ▪ ▪ ▪ ▪ ▪ ▪
3. ▪ ▪ ▪ ▪
4. ▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪
7. ▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪
8. ▪ ▪ ▪
12. ▪ ▪ ▪ ▪ ▪ ▪
13. ▪ ▪ ▪ ▪ ▪ ▪ ▪ ▪
14. String query = "select * from customers where group = "; query += request.getParameter("group"); rowMapper = new RowMapper<Customer>() { @Override public Customer mapRow(ResultSet rs, int rowNum) throws SQLException { return new Customer(rs.getLong("id"), rs.getString("first_name"), rs.getString("group")); } }; jdbcTemplate.query(query, new Object[] {}, rowMapper); http://host.tld/customers?group=12
15. String query = "select * from customers where group = " query += request.getParameter("group"); jdbcTemplate.query(query, new Object[] {}, rowMapper); http://host.tld/query?group=1 OR 1=1 SELECT * FROM customers where group=1 OR 1=1
18. ▪ ▪
19. ▪ ▪ … ▪ ▪ … ▪ ▪ ▪ ▪
20. ▪ ▪ ▪
21. <html> <h1>Comentarios</h1> <h3>Hola!</h3> <p><script>alert("Controlado por el intruso")</script></p> </html>
23. /hello?name=<script>alert(‘xss’)</script> <p>Hi <script>alert(‘xss’)</script></p> @RequestMapping("/hello") @ResponseBody protected String handleHello(HttpServletRequest request){ String name = request.getParameter("name"); return String.format(“<p>Hi %s</p>", name); }
24. /hello?name=<script>alert(‘xss’)</script> <p>Hi &lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;</p> Hi <script>alert(‘xss’)</script> import org.springframework.web.util.HtmlUtils; @RequestMapping("/hello") @ResponseBody protected String handleHello(HttpServletRequest request){ String name = request.getParameter("name"); return String.format("<p>Hi %s</p>", HtmlUtils.htmlEscape(name)); }
26. ▪ ▪ ▪
27. ▪ ▪ <img src=http://home-banking.com/transfer?dst=1234&amount=3>
30. ▪ •
31. ▪
33. ▪ ▪
35. ▪ ▪
36. ▪ …
37. ▪ ▪ if not has_authorization(user, action, object): raise AuthorizationException(user, action, object) action(user, object)
39. ▪ ▪ ▪ ▪