The software generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in “require,” “include,” or similar functions.
In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the software will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.
Modes of Introduction:
– Implementation
Likelihood of Exploit: High
CWE-706
CWE-829
CWE-94
CWE-426
Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
The attacker may be able to specify arbitrary code to be executed from a remote location. Alternatively, it may be possible to use normal program behavior to insert php code into files on the local machine which can then be included and force the code to execute since php ignores everything in the file except for the content between php specifiers.
Phase: Architecture and Design
Effectiveness:
Description:
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Phase: Architecture and Design
Effectiveness:
Description:
Phase: Architecture and Design
Effectiveness:
Description:
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Phase: Architecture and Design, Operation
Effectiveness: Limited
Description:
The effectiveness of this mitigation depends on the prevention capabilities of the specific sandbox or jail being used and might only help to reduce the scope of an attack, such as restricting the attacker to certain system calls or limiting the portion of the file system that can be accessed.
Phase: Architecture and Design, Operation
Effectiveness:
Description:
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Phase: Implementation
Effectiveness: High
Description:
Phase: Architecture and Design, Operation
Effectiveness:
Description:
Phase: Architecture and Design, Implementation
Effectiveness:
Description:
Phase: Operation
Effectiveness: Moderate
Description:
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
An application firewall might not cover all possible input vectors. In addition, attack techniques might be available to bypass the protection mechanism, such as using malformed inputs that can still be processed by the component that receives those inputs. Depending on functionality, an application firewall might inadvertently reject or modify legitimate requests. Finally, some manual effort may be required for customization.
Phase: Operation, Implementation
Effectiveness:
Description:
Develop and run your code in the most recent versions of PHP available, preferably PHP 6 or later. Many of the highly risky features in earlier PHP interpreters have been removed, restricted, or disabled by default.
Phase: Operation, Implementation
Effectiveness:
Description:
Phase: Operation
Effectiveness: High
Description:
Set allow_url_fopen to false, which limits the ability to include files from remote locations.
Be aware that some versions of PHP will still accept ftp:// and other URI schemes. In addition, this setting does not protect the code from path traversal attacks (CWE-22), which are frequently successful against the same vulnerable code that allows remote file inclusion.
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: High
Confidentiality, Integrity: Read Application Data, Modify Application Data, Read Files or Directories, Modify Files or Directories
An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information.
Phase: Implementation
Effectiveness:
Description:
The software uses or accesses a file descriptor after it has been closed.
After a file descriptor for a particular file or device has been released, it can be reused. The code might not write to the original file, since the reused file descriptor might reference a different file or device.
Modes of Introduction:
– Implementation
Likelihood of Exploit: Medium
Confidentiality: Read Files or Directories
The program could read data from the wrong file.
Availability: DoS: Crash, Exit, or Restart
Accessing a file descriptor that has been closed can cause a crash.
The software uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.
Reference counts can be used when tracking how many objects contain a reference to a particular resource, such as in memory management or garbage collection. When the reference count reaches zero, the resource can be de-allocated or reused because there are no more objects that use it. If the reference count accidentally reaches zero, then the resource might be released too soon, even though it is still in use. If all objects no longer use the resource, but the reference count is not zero, then the resource might not ever be released.
Modes of Introduction:
– Implementation
Likelihood of Exploit: Medium
The software contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the software’s users or administrators.
Hidden functionality can take many forms, such as intentionally malicious code, “Easter Eggs” that contain extraneous functionality such as games, developer-friendly shortcuts that reduce maintenance or support costs such as hard-coded accounts, etc. From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the software’s attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Other, Integrity: Varies by Context, Alter Execution Logic
Phase: Installation
Effectiveness:
Description:
Always verify the integrity of the software that is being installed.
Phase: Testing
Effectiveness:
Description:
Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.
The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Integrity: Execute Unauthorized Code or Commands
Other, Integrity: Varies by Context, Alter Execution Logic
Phase: Implementation
Effectiveness:
Description:
For any externally-influenced input, check the input against an allowlist of acceptable values.
Phase: Implementation, Architecture and Design
Effectiveness:
Description:
Refactor the code so that it does not need to be dynamically managed.
The software does not properly restrict reading from or writing to dynamically-identified variables.
Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Integrity: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity: Execute Unauthorized Code or Commands
Other, Integrity: Varies by Context, Alter Execution Logic
Phase: Implementation
Effectiveness:
Description:
For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
Phase: Implementation, Architecture and Design
Effectiveness:
Description:
Refactor the code so that internal program variables do not need to be dynamically identified.
The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Integrity: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity: Execute Unauthorized Code or Commands
Other, Integrity: Varies by Context, Alter Execution Logic
Phase: Implementation
Effectiveness:
Description:
Phase: Architecture and Design, Implementation
Effectiveness:
Description:
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Phase: Implementation
Effectiveness:
Description:
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
Phase: Implementation, Architecture and Design
Effectiveness:
Description:
Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity
If an attacker can gain access to the hashes, then the lack of sufficient computational effort will make it easier to conduct brute force attacks using techniques such as rainbow tables, or specialized hardware such as GPUs, which can be much faster than general-purpose CPUs for computing hashes.
Phase: Architecture and Design
Effectiveness: High
Description:
Phase: Implementation, Architecture and Design
Effectiveness:
Description:
When using industry-approved techniques, use them correctly. Don’t cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.