安全な ウェブサイトの 作り方 - ipa.go.jp

1 2015 3 URL .. 1 .. 2 .. 3 .. 3 7 .. 3 .. 4 1.. 5 SQL .. 6 OS .. 10 .. 13 .. 16 .. 22 CSRF .. 30 HTTP .. 34 .. 38 .. 41 .. 44 .. 46 2.. 48 .. 48 DNS .. 49 .. 51 .. 53 .. 55 WAF .. 58 .. 64 3.. 71 SQL .. 71 OS .. 77 .. 79 .. 81 .. 84 CSRF .. 95 HTTP .. 99 .. 100 .. 103 .. 104 .. 105 CWE .. 109 .. 111 2 1 2015 1 IPA 2 2014 12 10.

2 655 SQL OS IPA 1 2 IPA 3 IPA 3 1 SQL OS 11 2 7 3 1 8 CWE 7 7 1 URL 2 DNS URL 4

3 2 SQL 5 1.

4 3 SQL OS CSRF HTTP 3 SQL 6 SQL SQL SQL SQL SQL SQL - - - 4 - OS 5 4 5 MySQL, PostgreSQL, Oracle, Microsoft SQL Server, DB2 SQL SQL SQL SQL 7 6 SQL 2014 4 11% IPA DBD.

5 PgPP SQL Piwigo SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL ISO/JIS (Prepared Statement) SQL SQL SQL SQL SQL ' '' \ \\ 6 URL SQL SQL API SQL 1-(i)-a 1-(i)

6 -b SQL 8 API7 SQL SQL hidden SQL SQL SQL SQL SQL SQL 7 API SQL 1-(ii) 1-(iii) 1-(iv) SQL 9 CWE CWE-89 SQL CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ( ) URL IPA SQL #sql IPA ( ) 1.

7 SQL IPA 2014 OS 10 OS OS OS OS OS - - OS - - 8 8 Perl open(), system(), eval() PHP exec(), passthru(), shell_exec(), system(), popen() OS OS OS OS OS OS OS 11 OS Perl CGI IPA ASUS LAN OS Usermin OS Movable Type OS Perl open Perl open | OS 9 Perl sysopen

8 OS | < > OS OS 9 1 3 2-(i) 2-(ii) OS 12 CWE CWE-78 OS CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') URL IPA ( ) 5. OS / 13 - - ID / 14 IPA

9 CGI Spring Framework VMware ESX ESXi HTML hidden filename open(filename) open(filename) filename dirname open(dirname+filename) ../ basename() API open(dirname+basename(filename)) filename 10 10 3-(i)-a 3-(i)-b 3-(ii) / 15 /.

10 / ..\ OS URL URL %2F ..%2F ..%5C %252F ..%252F ..%255C CWE CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') URL IPA ( ) 4. IPA [2014 4 10 12 ] 1-4. #t04 3-(iii) 16 ID ID ID ID sid=abcd1236 ID sid=abcd1236 ID sid=abcd1235 ID sid=abcd1234 ID ID ID ID ID ID ID ID -b ID ID -a ID ID 17 ID Session Fixation ID 11 ID