Free DISA STIG and SRG Library | Vaulted

V-57565

The application server must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.

Finding ID
SRG-APP-000447-AS-000273
Rule ID
SV-71841r2_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-APP-000447-AS-000273
CCI
CCI-002754
Target Key
(None)
Documentable
No
Discussion

Invalid user input occurs when a user inserts data or characters into an applications data entry field and the application is unprepared to process that data. This results in unanticipated application behavior potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. Application servers must ensure their management interfaces perform data input validation checks. When invalid data is entered, the application server must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received. An example of a predictable behavior is trapping the data, logging the invalid data for forensic analysis if necessary, and continuing operation in a safe and secure manner.

Fix Text

Configure the application server management interface to behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.

Check Content

Review the application server configuration to determine if the management interface behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received. If the application server does not meet this requirement, this is a finding.