Difference between revisions of "Member Field Race Condition"

From OWASP
Jump to: navigation, search
 
Line 2: Line 2:
 
{{Template:Fortify}}
 
{{Template:Fortify}}
  
==Abstract==
+
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 +
 
 +
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 +
 
 +
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 +
 
 +
[[ASDR Table of Contents]]
 +
__TOC__
  
Servlet member fields may allow one user to see another user's data.
 
  
 
==Description==
 
==Description==
 +
 +
Servlet member fields may allow one user to see another user's data.
  
 
Many Servlet developers do not understand that, unless a Servlet implements the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the Servlet, and that single instance is used and re-used to handle multiple requests that are processed simultaneously by different threads.
 
Many Servlet developers do not understand that, unless a Servlet implements the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the Servlet, and that single instance is used and re-used to handle multiple requests that are processed simultaneously by different threads.
Line 12: Line 20:
 
A common result of this misunderstanding is that developers use Servlet member fields in such a way that one user may inadvertently see another user's data. In other words, storing user data in Servlet member fields introduces a data access race condition.
 
A common result of this misunderstanding is that developers use Servlet member fields in such a way that one user may inadvertently see another user's data. In other words, storing user data in Servlet member fields introduces a data access race condition.
  
==Examples ==
+
==Risk Factors==
 +
 
 +
* Talk about the [[OWASP Risk Rating Methodology|factors]] that make this vulnerability likely or unlikely to actually happen
 +
* Discuss the technical impact of a successful exploit of this vulnerability
 +
* Consider the likely [business impacts] of a successful attack
 +
 
 +
 
 +
==Examples==
  
 
The following Servlet stores the value of a request parameter in a member field and then later echoes the parameter value to the response output stream.
 
The following Servlet stores the value of a request parameter in a member field and then later echoes the parameter value to the response output stream.
Line 39: Line 54:
 
Thereby showing the first user the second user's name.
 
Thereby showing the first user the second user's name.
  
==Related Threats==
+
==Related [[Attacks]]==
  
==Related Attacks==
+
* [[Attack 1]]
 +
* [[Attack 2]]
  
==Related Vulnerabilities==
 
  
==Related Countermeasures==
+
==Related [[Vulnerabilities]]==
  
==Categories==
+
* [[Vulnerability 1]]
 +
* [[Vulnerabiltiy 2]]
  
[[Category:Synchronization and Timing Vulnerability]]
 
  
[[Category:Java]]
+
==Related [[Controls]]==
  
[[Category:Implementation]]
+
* [[Control 1]]
 +
* [[Control 2]]
  
 +
 +
==Related [[Technical Impacts]]==
 +
 +
* [[Technical Impact 1]]
 +
* [[Technical Impact 2]]
 +
 +
 +
==References==
 +
Note: A reference to related [http://cwe.mitre.org/ CWE] or [http://capec.mitre.org/ CAPEC] article should be added when exists. Eg:
 +
 +
* [http://cwe.mitre.org/data/definitions/79.html CWE 79].
 +
* http://www.link1.com
 +
* [http://www.link2.com Title for the link2]
 +
 +
[[Category:FIXME|add links
 +
 +
In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 +
 +
Availability Vulnerability
 +
 +
Authorization Vulnerability
 +
 +
Authentication Vulnerability
 +
 +
Concurrency Vulnerability
 +
 +
Configuration Vulnerability
 +
 +
Cryptographic Vulnerability
 +
 +
Encoding Vulnerability
 +
 +
Error Handling Vulnerability
 +
 +
Input Validation Vulnerability
 +
 +
Logging and Auditing Vulnerability
 +
 +
Session Management Vulnerability]]
 +
 +
__NOTOC__
 +
 +
 +
[[Category:OWASP ASDR Project]]
 +
[[Category:Synchronization and Timing Vulnerability]]
 +
[[Category:Java]]
 +
[[Category:Implementation]]
 
[[Category:Code Snippet]]
 
[[Category:Code Snippet]]

Revision as of 12:25, 26 September 2008

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

This article includes content generously donated to OWASP by Fortify.JPG.

Last revision (mm/dd/yy): 09/26/2008

Vulnerabilities Table of Contents

ASDR Table of Contents


Description

Servlet member fields may allow one user to see another user's data.

Many Servlet developers do not understand that, unless a Servlet implements the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the Servlet, and that single instance is used and re-used to handle multiple requests that are processed simultaneously by different threads.

A common result of this misunderstanding is that developers use Servlet member fields in such a way that one user may inadvertently see another user's data. In other words, storing user data in Servlet member fields introduces a data access race condition.

Risk Factors

  • Talk about the factors that make this vulnerability likely or unlikely to actually happen
  • Discuss the technical impact of a successful exploit of this vulnerability
  • Consider the likely [business impacts] of a successful attack


Examples

The following Servlet stores the value of a request parameter in a member field and then later echoes the parameter value to the response output stream.

	public class GuestBook extends HttpServlet {
	
	   String name;
	
	   protected void doPost (HttpServletRequest req,
						   HttpServletResponse res) {
		 name = req.getParameter("name");
		 ...
		 out.println(name + ", thanks for visiting!");
	   }
	}

While this code will work perfectly in a single-user environment, if two users access the Servlet at approximately the same time, it is possible for the two request handler threads to interleave in the following way:

 Thread 1: assign "Dick" to name
 Thread 2: assign "Jane" to name
 Thread 1: print "Jane, thanks for visiting!"
 Thread 2: print "Jane, thanks for visiting!"

Thereby showing the first user the second user's name.

Related Attacks


Related Vulnerabilities


Related Controls


Related Technical Impacts


References

Note: A reference to related CWE or CAPEC article should be added when exists. Eg: