The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Preventing ActiveX Vulnerabilities

Defending compiled software components against attack is a large and complex

area, and goes beyond the scope of this book. Basically, the designers and devel-

opers of an ActiveX control must ensure that the methods that it implements 

456

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 456

---

Figure 12-12: COMRaider showing the methods of an ActiveX control

cannot be invoked by a malicious web site to carry out undesirable actions

against a user who has installed it. For example: 

■■

A security-focused source code review and penetration test should be car-

ried out on the control to locate vulnerabilities such as buffer overflows.

■■

The control should not expose any inherently dangerous methods that

call out to the file system or operating system using user-controllable

input. Safer alternatives are usually available with minimal extra effort.

For example, if it is considered necessary to launch external processes,

compile a list of all the external processes that may legitimately and

safely be launched, and either create a separate method to call each one

or use a single method that takes an index number into this list.

As an additional defense-in-depth precaution, some ActiveX controls vali-

date the domain name that issued the HTML page from which they are being

invoked. Some controls go even further than this, and require that all parame-

ters passed to the control must be cryptographically signed. If an unautho-

rized domain attempts to invoke the control, or the signature passed is invalid,

the control does not carry out the requested action. You should be aware that

some defenses of this kind can be circumvented if the web site that is permit-

ted to invoke the control contains any XSS vulnerabilities.