Daily Archives: May 26, 2022

CWE

CWE-615 – Inclusion of Sensitive Information in Source Code Comments

Read Time:51 Second

Description

While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

An attacker who finds these comments can map the application’s structure and files, expose hidden parts of the site, and study the fragments of code to reverse engineer the application, which may help develop further attacks against the site.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-540
CWE-546

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

Phase: Distribution

Description: 

Remove comments which have sensitive information about the design/implementation of the application. Some of the comments may be exposed to the user and affect the security posture of the application.

CVE References

  • CVE-2007-6197
    • Version numbers and internal hostnames leaked in HTML comments.
  • CVE-2007-4072
    • CMS places full pathname of server in HTML comment.
  • CVE-2009-2431
    • blog software leaks real username in HTML comment.
CWE

CWE-614 – Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Read Time:1 Minute, 7 Second

Description

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-311

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

Phase: Implementation

Description: 

Always set the secure attribute when the cookie should sent via HTTPS only.

CVE References

  • CVE-2004-0462
    • A product does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the product.
  • CVE-2008-3663
    • A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
  • CVE-2008-3662
    • A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
  • CVE-2008-0128
    • A product does not set the secure flag for a cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CWE

CWE-613 – Insufficient Session Expiration

Read Time:18 Second

Description

According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-672
CWE-672
CWE-287

 

Consequences

Access Control: Bypass Protection Mechanism

 

Potential Mitigations

Phase: Implementation

Description: 

Set sessions/credentials expiration date.

CVE References

CWE

CWE-612 – Improper Authorization of Index Containing Sensitive Information

Read Time:48 Second

Description

The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.

Web sites and other document repositories may apply an indexing routine against a group of private documents to facilitate search. If the index’s results are available to parties who do not have access to the documents being indexed, then attackers could obtain portions of the documents by conducting targeted searches and reading the results. The risk is especially dangerous if search results include surrounding text that was not part of the search query. This issue can appear in search engines that are not configured (or implemented) to ignore critical files that should remain hidden; even without permissions to download these files directly, the remote user could read them.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-1230

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

CVE References

CWE

CWE-611 – Improper Restriction of XML External Entity Reference

Read Time:1 Minute, 36 Second

Description

The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-610
CWE-610
CWE-441

 

Consequences

Confidentiality: Read Application Data, Read Files or Directories

If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system.

Integrity: Bypass Protection Mechanism

The DTD may include arbitrary HTTP requests that the server may execute. This could lead to other attacks leveraging the server’s trust relationship with other entities.

Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

The software could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.

 

Potential Mitigations

Phase: Implementation, System Configuration

Description: 

Many XML parsers and validators can be configured to disable external entity expansion.

CVE References

  • CVE-2005-1306
    • A browser control can allow remote attackers to determine the existence of files via Javascript containing XML script.
  • CVE-2012-2239
    • XXE in PHP application allows reading the application’s configuration file.
  • CVE-2012-4399
    • XXE in rapid web application development framework allows reading arbitrary files.
  • CVE-2011-4107
    • XXE in web-based administration tool for database.
  • CVE-2010-3322
    • XXE in product that performs large-scale data analysis.
  • CVE-2009-1699
    • XXE in XSL stylesheet functionality in a common library used by some web browsers.
CWE

CWE-610 – Externally Controlled Reference to a Resource in Another Sphere

Read Time:15 Second

Description

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-664

 

Consequences

Confidentiality, Integrity: Read Application Data, Modify Application Data

 

Potential Mitigations

CVE References

CWE

CWE-61 – UNIX Symbolic Link (Symlink) Following

Read Time:1 Minute, 44 Second

Description

The software, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files.

A software system that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.

Modes of Introduction:

– Implementation

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-59
CWE-362
CWE-340
CWE-386
CWE-732

 

Consequences

Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

 

Potential Mitigations

Phase: Implementation

Description: 

Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.

Phase: Architecture and Design

Description: 

CVE References

  • CVE-1999-1386
    • Some versions of Perl follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack.
  • CVE-2000-1178
    • Text editor follows symbolic links when creating a rescue copy during an abnormal exit, which allows local users to overwrite the files of other users.
  • CVE-2004-0217
    • Antivirus update allows local users to create or append to arbitrary files via a symlink attack on a logfile.
  • CVE-2003-0517
    • Symlink attack allows local users to overwrite files.
  • CVE-2000-0972
    • Setuid product allows file reading by replacing a file being edited with a symlink to the targeted file, leaking the result in error messages when parsing fails.
CWE

CWE-609 – Double-Checked Locking

Read Time:1 Minute, 6 Second

Description

The program uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.

Double-checked locking refers to the situation where a programmer checks to see if a resource has been initialized, grabs a lock, checks again to see if the resource has been initialized, and then performs the initialization if it has not occurred yet. This should not be done, as is not guaranteed to work in all languages and on all architectures. In summary, other threads may not be operating inside the synchronous block and are not guaranteed to see the operations execute in the same order as they would appear inside the synchronous block.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-667
CWE-367

 

Consequences

Integrity, Other: Modify Application Data, Alter Execution Logic

 

Potential Mitigations

Phase: Implementation

Description: 

While double-checked locking can be achieved in some languages, it is inherently flawed in Java before 1.5, and cannot be achieved without compromising platform independence. Before Java 1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the “volatile” keyword allows double-checked locking to work successfully, although there is some debate as to whether it achieves sufficient performance gains. See references.

CVE References

CWE

CWE-608 – Struts: Non-private Field in ActionForm Class

Read Time:26 Second

Description

An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-668

 

Consequences

Integrity, Confidentiality: Modify Application Data, Read Application Data

 

Potential Mitigations

Phase: Implementation

Description: 

Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.

CVE References

CWE

CWE-607 – Public Static Final Field References Mutable Object

Read Time:20 Second

Description

A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-471

 

Consequences

Integrity: Modify Application Data

 

Potential Mitigations

Phase: Implementation

Description: 

Protect mutable objects by making them private. Restrict access to the getter and setter as well.

CVE References