MDonaghy648396 (Community Member) asked a question.
The dynamic scan report contains:
"It is possible to execute arbitrary OS commands at https://WEBURL/chat/194/wkueus0f/xhr?t=%28%29+%7B+%3A%3B%7D%3B+%2Fbin%2Fsleep+20%7C%2Fsbin%2Fsleep+20%7C%2Fusr%2Fbin%2Fsleep+20 by injecting () { :;}; /bin/sleep 20|/sbin/sleep 20|/usr/bin/sleep 20 into the t parameter. OS command injection attacks are exploited by using shell meta characters to escape, or break out of, the hardcoded command and issue additional commands on the system. This particular issue was identified due to a weakness in older versions of the bash shell. Please see http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 for more information."
The version of Bash we are running is bash 4.2.46(2)-release which contains the fix for CVE-2014-6271. The flaw complains about the URL above which is created by Spring web sockets using STOMP with fallback to SockJS. The URL is dynamic and created by the Spring web sockets library. I cannot reproduce the flaw. How is the Veracode scanner finding the URL and parameters?
.png){kind=logo}
Hi @MDonaghy648396 (Community Member) ,
Veracode Dynamic Analysis tests for presence of this flaw by sending a 'normal' payload and a 'slow' playload (with sleeps) 3 times and ensuring the timing for the response differs significantly.
We do this to be production safe, however, this may result in false positives if for example the server detects the payload and triggers a slow exception path or by coincidence the server happens to return slow responses for the slow payload.
If you believe this flaw was found in error we generally recommend running a new analysis, if the timing was a coincidence then this will automatically close the flaw.
If this does not close the flaw you might consider manually running the given payload on a development version of the application and debugging to see why this performs slower.
If you have any remaining questions or concerns I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema
Thanks Boy, that helped me work out that it was a false positive as the behaviour with normal and slow payloads were the same. A new scan then completed and the flaw no longer appears.
Thanks,
Martin