Privacy Violation: Image

ABSTRACT

應用程序服務器將敏感信息以未加密格式保留在磁盤上。此數據可能永遠不會被刪除。

EXPLANATION

如果圖表包含敏感信息，配置圖表圖像處理程序以將圖像保留在磁盤上可能會導致 privacy violation 漏洞。

例 1：web.config 文件中的以下程序設置可強制數據可視化控件將其生成的所有圖表保留在磁盤上：

<configuration>
	<appSettings>
<add key="ChartImageHandler" value="storage=file;timeout=20;deleteAfterServicing=false;" />
</appSettings>
</configuration>

add 元素的 value 屬性包含 "storage=file" 設置。如果任一數據可視化控件將敏感數據顯示給用戶，就會產生問題，因為 .NET 是將圖像以未加密格式存儲在磁盤上。

更糟糕的是，此元素包含 "deleteAfterServicing=false" 問題屬性。這會指示 .NET 在基礎架構提供圖像給用戶后，不要刪除該圖像。如果該圖像包含敏感信息，.NET 不會將其刪除，以供日后查看。

REFERENCES

[1] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A6 Information Leakage and Improper Error Handling

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3210.1 CAT II, APP3310 CAT I, APP3340 CAT I

[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3210.1 CAT II, APP3310 CAT I, APP3340 CAT I

[4] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 359

[5] ImageStorageMode Enumeration Microsoft

[6] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Information Leakage

[7] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.5, Requirement 8.4

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.6, Requirement 8.4

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 8.4

97av