Why This Issue Is Important
Using JSON.stringify() to cast the request content object to a string can introduce a serious security vulnerability in an Apigee proxy. This approach may allow attackers to exploit the system through Denial-of-Service (DoS) attacks. When an object is stringified without prior validation, it can lead to unexpected behavior, and malicious users might send crafted payloads that overwhelm the system, causing the Apigee instance to become unavailable.
The critical problem here is the absence of proper validation before stringifying the request content. This violates key security requirements that mandate validation of all incoming data before processing. Without such validation, the system could process malformed or malicious data, leading to instability or service disruptions.
How This Issue Is Detected
CodeSent detects this issue by analyzing the flow of steps within the proxy configuration. Here’s how it works:
Check for JSONThreatProtection Policy
CodeSent examines all the steps preceding the current one to see if a JSONThreatProtection policy has been applied. This policy is crucial as it ensures that the request content is safe before any operations like stringifying are performed.
Identify Use of JSON.stringify()
CodeSent then inspects the request.content variable to identify if JSON.stringify() has been applied. It does this by tracing the operations performed on this variable and flags any instances where the whole variable or even it part appears in JSON.stringify().
Create a Trace and Raise an Issue
If CodeSent finds that JSON.stringify() is applied to request.content without prior JSON threat protection, it creates a trace highlighting the steps leading to this vulnerability.
An issue is then raised, identifying this as a significant security risk, especially if the request content is handled without proper validation.
How to Fix the Issue
To fix this issue, either remove the use of JSON.stringify() on the request content or ensure that a JSONThreatProtection policy is applied before this step. This policy will validate the JSON content, reducing the risk of malicious payloads causing unexpected behavior or leading to a DoS attack.