Parameter Manipulation attack on ASP.NET MVC web site

Most of the ASP.NET MVC web site security patterns I have seen are focused on stopping non-authenticated users from accessing the site, or non-authorised users from accessing methods.

These methods work really well to secure the site.

However, in developing an ASP.NET MVC web site I learned the hard way that the patterns in tutorial and training materials for ASP.NET MVC are prone to parameter manipulation attacks.

Luckily for me it was identified during a pen test, and could be fixed.

The problem is that most of the examples you see rely on passing record keys to methods. The user is authenticated, and is authorised to use the methods. The problem occurs when the user decides to manipulate the record keys - this calling a method with a record key that you did not provide them.

For example, if you have an EditUser method that accepts a user id as a key parameter. The method is called by a button on a page (say a search page), that posts the form with the key value in a field. The malicious user can save the web page to a local file, modify the key value, load the page into the current sessions browser window, and submit the form.

The anti-forgery token is valid, the user is valid, the user is authorised - however they are now viewing or editing a user they were not supposed to.

The ASP.NET MVC developer needs to be aware of this vulnerability, and re-check that the user has rights to the records they are viewing or editing when the parameters are returned.

This can be done by performing the authorisation check again, storing the valid values in session state, encrypting keys, or any other method you care to use, however you can not trust that the parameter has not been tampered with when you receive it!

BEWARE Reference variables in LINQ Lambda Expressions

I have come across a 'feature' of LINQ and lambda expressions where the variables used in the lambda are stored by reference, and changing them before you are finished with the result set cause the result set to change on the fly!

Now I am not across the inner workings of LINQ and lambda, however the results from doing the following code are not what I would have expected.

private void button1_Click(object sender, EventArgs e)
{
System.Diagnostics.Debug.WriteLine("Testing:" + DateTime.Now.ToString());
List<Dictionary<int, int>> ld = new List<Dictionary<int, int>>();

ld.Add(new Dictionary<int, int>() { { 1, 10 }, { 2, 20 }, { 3, 30 } });
ld.Add(new Dictionary<int, int>() { { 1, 20 }, { 2, 300000}, { 3, 40000000 }, { 4, 500000000 }});

int indx = 10;

var ds = ld.Where(itm => itm[1] == indx);

if (ds.Count() > 0)
{
System.Diagnostics.Debug.WriteLine("Count=" + ds.First().Count());
indx = ds.First()[2]; //this is a value I want to keep for later
int valueIwant = ds.First()[3]; //this is the value I want from this result

System.Diagnostics.Debug.WriteLine("Value I Want=" + valueIwant);
//oh no ??? that's not the value I wanted ???
System.Diagnostics.Debug.WriteLine("Count=" + ds.First().Count());
//and now the count changed ???
}

}

I would expect the LINQ query to return the first row, (where itm[key==1] == 10).

And valueIwant to equal the third value in that result dictionary (itm[key==3]).

The first count confirms we are working with row 1 with 3 records in the result dictionary.

HOWEVER, changing the indx value prior to getting valueIwant causes the result to change dynamically - thus returning a new result set, which in this case is row 2.

The end result in my variable is 40000000 - big diff. And the final count is 4, as it is the second record now.

This is a real trap - especially when using LINQ/lambda to work down a hierarchy of values.

My suggestion would be to use a pattern where any lambda expressions that use a variable should have the variable assigned to a lambda specific variable prior to creating the expression.

i.e.

int indx = 10;

int tmpidx = intidx;

var ds = ld.Where(itm => itm[1] == tmpidx);

if (ds.Count() > 0)

{

indx = ds.First()[2]; //this is a value I want to keep for later

int valueIwant = ds.First()[3]; //now I get what I wanted !!!!

I can't determine if this is by-design, a feature to support delegates, or a genuine bug, but it is definately something to watch out for!

Update: The legends on the MSDN forum suggest using .ToList() on the end of the Where statement to generate a fixed list result - thus separating the result set from the object query. It is also noted that each call to Count() and First() will cause the expression to re-evaluate!

http://social.msdn.microsoft.com/Forums/en-US/linqprojectgeneral/thread/b1480b00-44ec-4b32-984f-cdd53d87e99d

Telstra MF636 3G modem in Windows 7

When I tried to get the Telstra 7 Series MF636 modem working in Windows 7 I found that it would load the connection manager software but fail to find the sim/modem.

To get the modem to work I had to use the 'Safely Remove Hardware...' option to eject the ZTE modem which was registered as a USB drive as well.

Once the USB drive was ejected, the connection manager would then take around 5 to 10 seconds to recognise the sim and modem and then everything works fine.

Best feature of Windows 7 ???

Recently setup W7 on my lappy (Toshiba P10).

Installation is quite simple, however getting the drivers (most of which are BETA) is a bit painful.

The best feature I have found so far is the mouse-over on the active windows on the task bar.

I dont recall Vista having anything like this?

When you mouse over an application the task bar, the thumbnails of the windows popup, and when you mouse over one of the thumbnails, all the other windows become transparent except for the moused-over application's window.

I think that is a great feature!

Using ROWNUMBER() to sort views!

Had a bit of an epiphany today when creating a view.

I needed to be able to join the view back on itself to create a running total column. In order to do this I thought I would use ROWNUMBER() to create a key and join on values less than that key.

In doing so I realised that ROWNUMBER() allows you to create a sorted view. This is something that anyone who has tried to create a sorted view will know can not be done unless you use a SELECT TOP statement, which is cludgey.

Using a " SELECT ROW_NUMBER() OVER(ORDER BY field1, field2, field3) AS 'ROWNUMBER', field1, field2, field3 ... FROM ... WHERE ... " statement however has the effect of sorting the values and you can use this to create a sorted view.

i.e.

CREATE VIEW vwTestView AS

SELECT ROW_NUMBER() OVER(ORDER BY field1, field2, field3) AS 'ROWNUMBER', field1, field2, field3 ... FROM ...

WHERE ...

Obviously this is only good if you are able to put the field in the view without upsetting anybody. But if you can it works well.

mailto: link in a HTML Popup

Today I had to use a HTML Popup to display some person details, including and email address.

To get the email link to launch a new email window I thought I could just insert the mailto: markup into the anchor in the popup body, however it did not respond.

I found that to get this to work I needed to insert my popup content into a DIV, pass the DIV content as the content for the popup body, and have the onclick event on the mail address anchor make a call to get the parent window to navigate to the mailto: URL.

All a bit cludgey, but it worked in the end. The resulting HTML looked like this:

<DIV id="data1" style="display:none">

<SPAN onclick="javascript:parent.window.navigate('mailto:xxxxxx@xxxx.xxx.xx')">

<B>Email:</B><a href="#" >xxxxxx@xxxx.xxx.xx</a></SPAN>

<BR> ... more HTML ...

</DIV>

<a href="#" onclick="javascript:

var oPopup = window.createPopup();

var oPopBody = oPopup.document.body;

oPopBody.style.backgroundColor = 'lightyellow';

oPopBody.style.border = 'solid black 1px';

oPopBody.innerHTML = data1.innerHTML;

oPopup.show(0, 16, 350, 75, event.srcElement);" style="text-decoration:none" >...</a>

Recently had to get a Telstra 21 3g card working with a Netcomm 3G wireless router N3G002W.

There were some hassles getting it all configured but the in the end it DOES WORK!

So the things to look for are:

• Dont turn off the radio when you disconnect the dongle from your pc. I just pulled it out to make sure. The option in the bigpond connection manager app to close and exit I think turns of the radio.
• Press and hold the SHIFT key when clicking on the OPTIONS in the telstra bigpond connection manager app. This gives you some extra tabs in the options dialog. Click the checkbox in one of the new tabs that says that the device is already registered.
• use telstra.bigpond as the APN, and put in the username and password. Other default settings worked fine.

Did not really see any speed increase over the 7.2 where I was though (country area) !

While trying to customise one of the themes from the TenThemesForSharePoint pack I found that whenever I modified and deployed the theme.css file and deployed, the changes did not take effect.

To get the changes to take effect I needed to open the browser, navigate to the sharepoint site, then go to Site Actions > Site Settings > Site Features and then Deactivate the theme, and then Re-Activate it. The new theme.css would then be applied. Additionally, sometimes I would need to press the Refresh button on the browser!

While trying to deploy themes using the TenThemesForSharePoint pack I kept on getting this error.

• Error 1 The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (text/xml; charset=utf-8). If using a custom encoder, be sure that the IsContentTypeSupported method is implemented properly. The first 1024 bytes of the response were: ...'

What I found was I needed to manually navigate to the VseWSS WCF service on my Sharepoint server to have it loaded, and then do the deploy. To do this, open a browser window and navigate to "http://yourserver:1378/SPService.svc"

This should open the service page with the link to the WSDL and some sample code. It also loads the service so the deploy can now run.

well, I thought I'd start a blog about all the tech problems that I seem to have to solve in my day-to-day work life.

I worked through some issues deploying some sharepoint themes today and I thought 'this is what I am always doing', and that some of the solutions I find would be helpful for others. So I should write a blog.

And here it is.

I'll post some solutions to me problems soon.

Hope it helps someone else.

Cheers

BB