Resource Injection

ID

java.resource_injection

Severity

high

Resource

Injection

Language

Java

Tags

CWE:99, NIST.SP.800-53, OWASP:2021:A3, PCI-DSS:6.5.1

Description

Improper control of resource identifiers ('Resource Injection').

Rationale

Resource Injection occurs when an attacker is able to manipulate inputs that are concatenated with paths, queries, or resource identifiers in such a way that unintended resources are accessed. The main risk is unauthorized access, data leakage, and potential modification or destruction of resources.

For example, consider this Java code snippet:

import java.io.InputStream;
import java.io.IOException;

public class ResourceInjectionExample {
    public void loadResource(String resourceName) throws IOException {
        // Potentially unsafe dynamic resource loading
        InputStream resource = getClass().getResourceAsStream("/resources/" + resourceName);
        if (resource == null) {
            throw new IOException("Resource not found: " + resourceName);
        }
        // Process the resource...
    }
}

In this example, resourceName is concatenated to construct a resource path. If resourceName can be influenced by user input without any validation or sanitization, an attacker could potentially access and load unintended resources within the application’s directory structure.

Remediation

The most common way to prevent resource injection vulnerabilities is to sanitize user input before using it in resource construction: Ensure that resource identifiers are strictly validated against a whitelist of known safe values. This prevents arbitrary input from being interpreted as a valid identifier.

If whitelisting is not possible, use a strict blacklist to limit the range of allowed identifiers.

Additional precautions include:

  • Privilege Segregation: Run resource access code under the least privilege principle. Design the application to minimize the access scope for sensitive resources.

  • Logging and Alerting: Implement comprehensive logging and alerting to monitor resource access, making clear which resources are accessed. This helps in early detection of suspicious activities or misuse.

  • Static Code Analysis: Utilize SAST tools with detectors that specifically check for untrusted input in resource construction. Regular scans will help identify new vulnerabilities introduced in your code base.

Configuration

The detector has the following configurable parameters:

  • sources, that indicates the source kinds to check.

  • neutralizations, that indicates the neutralization kinds to check.

Unless you need to change the default behavior, you typically do not need to configure this detector.

References