問60
頻出度★★★
クロスサイトスクリプティングの特徴に関する記述として, 適切なものはどれか。
平成24年度 秋期 ITパスポート試験 問60
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 60
- ア
正解 The correct answer is ア. Cross-Site Scripting (XSS) is an attack that exploits a vulnerability in a web application which embeds a string entered by a user directly into the page as HTML and returns it. The places targeted are those that output an input value to the screen, such as the posting field of a message board, a search keyword field, a confirmation screen for entered content, or an error message. Into such an input field the attacker plants not an ordinary string but a fragment of script containing a <script> tag or the like. If the site outputs it without escaping (neutralizing) special characters such as angle brackets, that script reaches the victim's web browser not as mere text but as a program, and it is executed as part of a page of that site. Because the executed script runs with the privileges of that site, it causes damage such as stealing the session ID stored in the user's cookie and sending it to the attacker (impersonation, session hijacking), displaying a fake input form to make the user enter an ID, a password, or a credit card number, and tampering with the page to lead the user to a different site. The name comes from the fact that the attacker's script is executed on another site (cross-site) by way of a trap site or a crafted link. Therefore ア, which says that it exploits a vulnerability whereby a malicious script contained in data entered into a website is sent unchanged to the web browser, is appropriate. Note that the core countermeasure is to reliably perform escape processing (sanitizing) at output time, together with validation of input values and the introduction of a WAF.
Incorrectイ
An attack that sends data longer than expected to a program that does not check the length of the input data is a buffer overflow attack. The portion that overflows from the prepared storage area (buffer) overwrites the adjacent memory area, and by rewriting such things as the return address, it makes the instructions planted by the attacker run or causes the system to terminate abnormally. What is made to overflow is memory on the server side, so both the mechanism and the way the damage occurs differ from XSS, which makes a script run in the victim's browser.
Incorrectウ
Something that disguises itself as useful software such as a handy tool or a game so that users themselves install it, and then performs unauthorized actions behind the scenes, is a Trojan horse (a type of malware). Its characteristic is that it deceives users into installing it; it does not exploit a vulnerability in a website's output processing. After it gets in, it does things such as sending information to the outside or setting up a backdoor, but this is not a description of XSS.
Incorrectエ
The function provided by word processing software and spreadsheet software that records operation steps so they can be called up and executed later is a macro, and something that abuses this to run unauthorized processing is a macro virus. Typically it infects and takes effect when a document file is opened, and its infection route is a document file attached to an email or the like. What it targets is the macro function of an application, which is different from XSS, which exploits a vulnerability in a website's input and output processing.
ここがポイント
- The essence of Cross-Site Scripting (XSS) is that it exploits a website vulnerability in which an entered string is output to the screen as it is, without escaping, so that the attacker's script runs in the victim's web browser. The main damage is impersonation through theft of the session ID in a cookie, and the swindling of information through a fake form; the key countermeasure is escape processing (sanitizing) at output time.
- Distinguish confusingly similar attack techniques by what they target: XSS targets a vulnerability in a web application that outputs input values unchanged, buffer overflow targets the memory of a program that does not check input length, SQL injection targets the query statement sent to a database, a Trojan horse targets the user's own judgment (deceiving them into installing it), and a macro virus targets the macro function of word processing and spreadsheet software.
用語