julz0815 / verademo

VeraDemo - Blab-a-Gag.

About

Blab-a-Gag is a fairly simple forum type application which allows:

• users to post a one-liner joke
• users to follow the jokes of other users or not (listen or ignore)
• users to comment on other users messages (heckle)

URLs

/reset will reset the data in the database with a load of:

• users
• jokes
• heckles

/feed shows the jokes/heckles that are relevant to the current user.

/blabbers shows a list of all other users and allows the current user to listen or ignore.

/profile allows the current user to modify their profile.

/login allows you to log in to your account

/register allows you to create a new user account

/tools shows a tools page that shows a fortune or lets you ping a host.

Configure

Build and installation requires Maven, MySQL and Tomcat.

The simplest way to aquire these on MacOS is via Homebrew. Install Homebrew then:

brew install maven mysql tomcat

Database

Set up a database in MySQL called blab with a user of blab and password z2^E6J4$;u;d.

Run

mvn package will build the web application and output a war file to target/verademo.war

Deploy the resulting war file to Tomcat (or run a SAST scan on it).

Open /reset in your browser and follow the instructions to prep the database

Login with your username/password as defined in Utils.java

AWS Deployment

Verademo will also run out-of-the-box in AWS. Simply upload the target/verademo.war file into a Tomcat Elastic Beanstalk environment (with associated Amazon RDS). The database credentials listed above are not required when running in AWS.

On the first environment deployment, a script will automatically setup the database. Subsequent application re-deploys (without environment re-deploy), or application server restarts will not alter the database.

Exploitation Demos

See the docs folder

verademo's Issues

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/RemoveAccountCommand.java:47]

Filename: com/veracode/verademo/commands/RemoveAccountCommand.java

Line: 47

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/RemoveAccountCommand.java:40]

Filename: com/veracode/verademo/commands/RemoveAccountCommand.java

Line: 40

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/ListenCommand.java:40]

Filename: com/veracode/verademo/commands/ListenCommand.java

Line: 40

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:59]

Filename: com/veracode/verademo/controller/ToolsController.java

Line: 59

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:166]

Filename: com/veracode/verademo/controller/UserController.java

Line: 166

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:316]

Filename: com/veracode/verademo/controller/UserController.java

Line: 316

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/ListenCommand.java:47]

Filename: com/veracode/verademo/commands/ListenCommand.java

Line: 47

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:56]

Filename: com/veracode/verademo/controller/ToolsController.java

Line: 56

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP WASC

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') [VID:95:WEB-INF/views/login.jsp:32]

Verademo/src/main/webapp/WEB-INF/views/login.jsp

Lines 27 to 37 in 9ae7692

	<![endif]-->
	</head>
	<body role="document">
	<script>
	eval('alert("Your query string was ' + unescape(document.location.search) + '");');
	</script>
	<div class="container">
	<div class="header clearfix">

Filename: WEB-INF/views/login.jsp

Line: 32

CWE: 95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))

This call to eval() contains untrusted input or potentially untrusted data. If this input could be modified by an attacker, arbitrary JS code could be executed. Validate all untrusted and untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. In general, avoid executing code derived from untrusted input. References: CWE

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/IgnoreCommand.java:47]

Filename: /src/main/java/com/veracode/verademo/commands/IgnoreCommand.java

Line: 47

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:505]

Filename: com/veracode/verademo/controller/UserController.java

Line: 505

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the myInfo object, which contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/IgnoreCommand.java:40]

Filename: com/veracode/verademo/commands/IgnoreCommand.java

Line: 40

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:91]

Filename:

Verademo/src/main/java/com/veracode/verademo/controller/ToolsController.java

Line 91 in a37540f

proc = Runtime.getRuntime().exec(cmd);

Line: 91

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variable cmd. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:384]

Filename: com/veracode/verademo/controller/UserController.java

Line: 384

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable query. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/RemoveAccountCommand.java:51]

Filename: com/veracode/verademo/commands/RemoveAccountCommand.java

Line: 51

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/BlabController.java:490]

Filename: com/veracode/verademo/controller/BlabController.java

Line: 490

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the blabberQuery object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:494]

Filename: com/veracode/verademo/controller/UserController.java

Line: 494

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlMyEvents. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:251]

Filename: com/veracode/verademo/controller/UserController.java

Line: 251

CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC