DISA STIG version 5 IDs: C#
This article maps DISA Security Technical Implementation Guide version 5 IDs to Klocwork C# checkers. For more information about DISA STIG, see the STIG web site.
| Rule | Checker name and description |
|---|---|
| V-222388 [APSC-DV-000060] (CAT 2): The application must clear temporary storage and cookies when the session is terminated. | |
| V-222396 [APSC-DV-000160] (CAT 2): The application must implement DoD-approved encryption to protect the confidentiality of remote access sessions. |
CS.RCA Risky cryptographic algorithm used CS.XSS.PERSIST Cross-site Scripting Persisting Vulnerability CS.XSS.REFLECT Cross-site Scripting Reflecting Vulnerability |
| V-222397 [APSC-DV-000170] (CAT 2): The application must implement cryptographic mechanisms to protect the integrity of remote access sessions. |
CS.RCA Risky cryptographic algorithm used |
| V-222399 [APSC-DV-000190] (CAT 1): Messages protected with WS_Security must use time stamps with creation and expiration times. | |
| V-222400 [APSC-DV-000200] (CAT 1): Validity periods must be verified on all application messages using WS-Security or SAML assertions. | |
| V-222403 [APSC-DV-000230] (CAT 1): The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion. | |
| V-222404 [APSC-DV-000240] (CAT 1): The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion. | |
| V-222425 [APSC-DV-000460] (CAT 1): The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. | |
| V-222427 [APSC-DV-000480] (CAT 2): The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies. | |
| V-222430 [APSC-DV-000510] (CAT 1): The application must execute without excessive account permissions. | |
| V-222432 [APSC-DV-000530] (CAT 1): The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period. | |
| V-222444 [APSC-DV-000650] (CAT 2): The application must not write sensitive data into the application logs. | |
| V-222501 [APSC-DV-001290] (CAT 2): The application must protect audit information from unauthorized modification. | |
| V-222511 [APSC-DV-001410] (CAT 2): The application must enforce access restrictions associated with changes to application configuration. | |
| V-222515 [APSC-DV-001460] (CAT 2): An application vulnerability assessment must be conducted. | |
| V-222522 [APSC-DV-001540] (CAT 1): The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | |
| V-222536 [APSC-DV-001680] (CAT 1): The application must enforce a minimum 15-character password length. | |
| V-222542 [APSC-DV-001740] (CAT 1): The application must only store cryptographic representations of passwords. |
CS.HCC Use of hardcoded credentials CS.HCC.PWD Use of a hardcoded password CS.HCC.USER Use of a hardcoded user name CS.RCA Risky cryptographic algorithm used |
| V-222543 [APSC-DV-001750] (CAT 1): The application must transmit only cryptographically-protected passwords. |
CS.HCC Use of hardcoded credentials CS.HCC.PWD Use of a hardcoded password CS.HCC.USER Use of a hardcoded user name CS.RCA Risky cryptographic algorithm used |
| V-222550 [APSC-DV-001810] (CAT 1): The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | |
| V-222551 [APSC-DV-001820] (CAT 1): The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key. | |
| V-222554 [APSC-DV-001850] (CAT 1): The application must not display passwords/PINs as clear text. | |
| V-222555 [APSC-DV-001860] (CAT 1): The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. |
CS.HCC Use of hardcoded credentials CS.HCC.PWD Use of a hardcoded password CS.HCC.USER Use of a hardcoded user name |
| V-222566 [APSC-DV-001980] (CAT 2): The application must terminate all sessions and network connections when non-local maintenance is completed. | |
| V-222567 [APSC-DV-001995] (CAT 2): The application must not be vulnerable to race conditions. | |
| V-222568 [APSC-DV-002000] (CAT 2): The application must terminate all network connections associated with a communications session at the end of the session. |
CS.RLK Resource leak |
| V-222571 [APSC-DV-002030] (CAT 2): The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes. |
CS.RCA Risky cryptographic algorithm used |
| V-222572 [APSC-DV-002040] (CAT 2): The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection. |
CS.RCA Risky cryptographic algorithm used |
| V-222577 [APSC-DV-002230] (CAT 1): The application must not expose session IDs. | |
| V-222578 [APSC-DV-002240] (CAT 1): The application must destroy the session ID value and/or cookie on logoff or browser close. | |
| V-222583 [APSC-DV-002290] (CAT 2): The application must use the Federal Information Processing Standard (FIPS) 140-2-validated cryptographic modules and random number generator if the application implements encryption, key exchange, digital signature, and hash functionality. |
CS.RCA Risky cryptographic algorithm used |
| V-222585 [APSC-DV-002310] (CAT 1): The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail. | |
| V-222589 [APSC-DV-002350] (CAT 2): The application must use appropriate cryptography in order to protect stored DoD information when required by the information owner or DoD policy. |
CS.RCA Risky cryptographic algorithm used |
| V-222590 [APSC-DV-002360] (CAT 2): The application must isolate security functions from non-security functions. | |
| V-222592 [APSC-DV-002380] (CAT 2): Applications must prevent unauthorized and unintended information transfer via shared system resources. | |
| V-222594 [APSC-DV-002400] (CAT 2): The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems. |
CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation |
| V-222596 [APSC-DV-002440] (CAT 1): The application must protect the confidentiality and integrity of transmitted information. | |
| V-222600 [APSC-DV-002480] (CAT 2): The application must not disclose unnecessary information to users. | |
| V-222601 [APSC-DV-002485] (CAT 1): The application must not store sensitive information in hidden fields. | |
| V-222602 [APSC-DV-002490] (CAT 1): The application must protect from Cross-Site Scripting (XSS) vulnerabilities. | |
| V-222603 [APSC-DV-002500] (CAT 2): The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities. |
CS.CSRF.ATTR.NOATTR AntiForgery attribute should be added to class or method. CS.CSRF.ATTR.POST AntiForgery attribute should be added to class or method. CS.CSRF.VALIDATE Validation of 'POST request data access' is not done. CS.CSRF.VSUK.CONSTASSIGN A const string is assigned to property 'ViewStateUserKey'. CS.CSRF.VSUK.NOASSIGN Property 'ViewStateUserKey' is not set. |
| V-222604 [APSC-DV-002510] (CAT 1): The application must protect from command injection. |
CS.SV.TAINTED.INJECTION C# command injection |
| V-222605 [APSC-DV-002520] (CAT 2): The application must protect from canonical representation vulnerabilities. | |
| V-222606 [APSC-DV-002530] (CAT 2): The application must validate all input. |
CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal |
| V-222607 [APSC-DV-002540] (CAT 1): The application must not be vulnerable to SQL Injection. |
CS.SV.USAGERULES.PERMISSIONS Use of Privilege Elevation |
| V-222608 [APSC-DV-002550] (CAT 1): The application must not be vulnerable to XML-oriented attacks. | |
| V-222609 [APSC-DV-002560] (CAT 1): The application must not be subject to input handling vulnerabilities. |
CS.SV.TAINTED.ALLOC_SIZE Use of unvalidated integer in memory allocation CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation CS.SV.TAINTED.FMTSTR Use of unvalidated data in a format string CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition CS.SV.TAINTED.PATH_TRAVERSAL Use of unvalidated data in a path traversal |
| V-222612 [APSC-DV-002590] (CAT 1): The application must not be vulnerable to overflow attacks. |
CS.SV.TAINTED.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.BINOP Use of unvalidated integer in binary operation CS.SV.TAINTED.CALL.INDEX_ACCESS Use of unvalidated integer as array index by function call CS.SV.TAINTED.CALL.LOOP_BOUND Use of unvalidated integer in loop condition through a function call CS.SV.TAINTED.DESERIALIZATION Use of unvalidated integer during deserialization in object creation CS.SV.TAINTED.INDEX_ACCESS Use of unvalidated integer as array index CS.SV.TAINTED.LOOP_BOUND Use of unvalidated integer in loop condition |
| V-222620 [APSC-DV-002890] (CAT 1): Application web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoD DMZ. | |
| V-222625 [APSC-DV-002950] (CAT 2): Execution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated. |
CS.BANNED.INVOKE Prefer asynchronous calls to synchronized calls |
| V-222641 [APSC-DV-003100] (CAT 2): The application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange. |
CS.RCA Risky cryptographic algorithm used |
| V-222642 [APSC-DV-003110] (CAT 1): The application must not contain embedded authentication data. | |
| V-222643 [APSC-DV-003120] (CAT 1): The application must have the capability to mark sensitive/classified output when required. | |
| V-222648 [APSC-DV-003170] (CAT 2): An application code review must be performed on the application. | |
| V-222656 [APSC-DV-003235] (CAT 2): The application must not be subject to error handling vulnerabilities. | |
| V-222658 [APSC-DV-003240] (CAT 1): All products must be supported by the vendor or the development team. | |
| V-222659 [APSC-DV-003250] (CAT 1): The application must be decommissioned when maintenance or support is no longer available. | |
| V-222662 [APSC-DV-003280] (CAT 1): Default passwords must be changed. | |
| V-222667 [APSC-DV-003320] (CAT 2): Protections against DoS attacks must be implemented. | |
| V-254803 [APSC-DV-002010] (CAT 2): The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. |
CS.RCA Risky cryptographic algorithm used |