text: Difference between revisions of "CRV2 FrameworkSpecIssuesdotNetMVC"
  Revision as of 03:49, 2 August 2013
  -
  Binding issues in MVC .NET
  A.K.A Over-Posting A.K.A Mass assignments
  In MVC framework, mass assignments is a mechanism that allow us to update our models with data coming in a request in HTTP form fields. As the data that needs to be updated comes in a collection of form fields, a user could send a request and modify other fields in the model that may not be in the form and the developer didn’t intend to be updated.
  Depending on the models you create, there might be sensitive data that you would not like to be modified. The vulnerability is exploited when a malicious user modifys a model’s fields which are not exposed to the user via the view and additional model parameters are added by the malicious user to change hidden model values.
  public class user { public int ID { get; set; } <- exposed via view public string Name { get; set; } <- exposed via view public bool isAdmin{ get; set; } <-hidden from view }
  Corresponding view (HTML)
  ID: <%= Html.TextBox("ID") %>
  Name: <%= Html.TextBox("Name") %>
  <-- no isAdmin here!
  The correspondig HTML for this model contain 2 fields: ID and Name. If an attacker adds the isAdmin parameter to the form and submitts they can change the model object above. So a malicious attacker may change isAdmin=true
  Recommendations:
  - -1 Use a model which does not have values the user should not edit.
  - -2 Use the bind method and whitelist attributes which can be updated.
  - -3 Use the controller.UpdateModel method to exclude certain attribute directive sp_executesql is a system stored procedure in Microsoft® SQL Server™
  Lets pass it.
  DROP TABLE ORDERS;
  Guess what happens? So we must be careful of not falling into the “We’re secure, we are using stored procedures” trap!
  The validation solution for .NET also has client and server side functionality akin to Struts (J2EE). What is a validator? According to the Microsoft .)