All posts by rocco

CWE

CWE-61 – UNIX Symbolic Link (Symlink) Following

Read Time:1 Minute, 44 Second

Description

The software, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files.

A software system that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.

Modes of Introduction:

– Implementation

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-59
CWE-362
CWE-340
CWE-386
CWE-732

 

Consequences

Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

 

Potential Mitigations

Phase: Implementation

Description: 

Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.

Phase: Architecture and Design

Description: 

CVE References

  • CVE-1999-1386
    • Some versions of Perl follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack.
  • CVE-2000-1178
    • Text editor follows symbolic links when creating a rescue copy during an abnormal exit, which allows local users to overwrite the files of other users.
  • CVE-2004-0217
    • Antivirus update allows local users to create or append to arbitrary files via a symlink attack on a logfile.
  • CVE-2003-0517
    • Symlink attack allows local users to overwrite files.
  • CVE-2000-0972
    • Setuid product allows file reading by replacing a file being edited with a symlink to the targeted file, leaking the result in error messages when parsing fails.
CWE

CWE-610 – Externally Controlled Reference to a Resource in Another Sphere

Read Time:15 Second

Description

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-664

 

Consequences

Confidentiality, Integrity: Read Application Data, Modify Application Data

 

Potential Mitigations

CVE References

CWE

CWE-611 – Improper Restriction of XML External Entity Reference

Read Time:1 Minute, 36 Second

Description

The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-610
CWE-610
CWE-441

 

Consequences

Confidentiality: Read Application Data, Read Files or Directories

If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system.

Integrity: Bypass Protection Mechanism

The DTD may include arbitrary HTTP requests that the server may execute. This could lead to other attacks leveraging the server’s trust relationship with other entities.

Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

The software could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.

 

Potential Mitigations

Phase: Implementation, System Configuration

Description: 

Many XML parsers and validators can be configured to disable external entity expansion.

CVE References

  • CVE-2005-1306
    • A browser control can allow remote attackers to determine the existence of files via Javascript containing XML script.
  • CVE-2012-2239
    • XXE in PHP application allows reading the application’s configuration file.
  • CVE-2012-4399
    • XXE in rapid web application development framework allows reading arbitrary files.
  • CVE-2011-4107
    • XXE in web-based administration tool for database.
  • CVE-2010-3322
    • XXE in product that performs large-scale data analysis.
  • CVE-2009-1699
    • XXE in XSL stylesheet functionality in a common library used by some web browsers.
CWE

CWE-612 – Improper Authorization of Index Containing Sensitive Information

Read Time:48 Second

Description

The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.

Web sites and other document repositories may apply an indexing routine against a group of private documents to facilitate search. If the index’s results are available to parties who do not have access to the documents being indexed, then attackers could obtain portions of the documents by conducting targeted searches and reading the results. The risk is especially dangerous if search results include surrounding text that was not part of the search query. This issue can appear in search engines that are not configured (or implemented) to ignore critical files that should remain hidden; even without permissions to download these files directly, the remote user could read them.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-1230

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

CVE References

CWE

CWE-613 – Insufficient Session Expiration

Read Time:18 Second

Description

According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-672
CWE-672
CWE-287

 

Consequences

Access Control: Bypass Protection Mechanism

 

Potential Mitigations

Phase: Implementation

Description: 

Set sessions/credentials expiration date.

CVE References

CWE

CWE-614 – Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Read Time:1 Minute, 7 Second

Description

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-311

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

Phase: Implementation

Description: 

Always set the secure attribute when the cookie should sent via HTTPS only.

CVE References

  • CVE-2004-0462
    • A product does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the product.
  • CVE-2008-3663
    • A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
  • CVE-2008-3662
    • A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
  • CVE-2008-0128
    • A product does not set the secure flag for a cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CWE

CWE-615 – Inclusion of Sensitive Information in Source Code Comments

Read Time:51 Second

Description

While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

An attacker who finds these comments can map the application’s structure and files, expose hidden parts of the site, and study the fragments of code to reverse engineer the application, which may help develop further attacks against the site.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-540
CWE-546

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

Phase: Distribution

Description: 

Remove comments which have sensitive information about the design/implementation of the application. Some of the comments may be exposed to the user and affect the security posture of the application.

CVE References

  • CVE-2007-6197
    • Version numbers and internal hostnames leaked in HTML comments.
  • CVE-2007-4072
    • CMS places full pathname of server in HTML comment.
  • CVE-2009-2431
    • blog software leaks real username in HTML comment.
CWE

CWE-616 – Incomplete Identification of Uploaded File Variables (PHP)

Read Time:1 Minute, 15 Second

Description

The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

These global variables could be overwritten by POST requests, cookies, or other methods of populating or overwriting these variables. This could be used to read or process arbitrary files by providing values such as “/etc/passwd”.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-345
CWE-473

 

Consequences

Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Use PHP 4 or later.

Phase: Architecture and Design

Description: 

If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES[‘userfile’]))

Phase: Implementation

Description: 

For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.

CVE References

  • CVE-2002-1460
    • Forum does not properly verify whether a file was uploaded or if the associated variables were set by POST, allowing remote attackers to read arbitrary files.
  • CVE-2002-1759
    • Product doesn’t check if the variables for an upload were set by uploading the file, or other methods such as $_POST.
  • CVE-2002-1710
    • Product does not distinguish uploaded file from other files.
CWE

CWE-617 – Reachable Assertion

Read Time:1 Minute, 15 Second

Description

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-670
CWE-670

 

Consequences

Availability: DoS: Crash, Exit, or Restart

An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker’s own session.

 

Potential Mitigations

Phase: Implementation

Description: 

Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)

Phase: Implementation

Description: 

Perform input validation on user data.

CVE References

  • CVE-2006-6767
    • FTP server allows remote attackers to cause a denial of service (daemon abort) via crafted commands which trigger an assertion failure.
  • CVE-2006-6811
    • Chat client allows remote attackers to cause a denial of service (crash) via a long message string when connecting to a server, which causes an assertion failure.
  • CVE-2006-5779
    • Product allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names, which triggers an assertion failure.
  • CVE-2006-4095
    • Product allows remote attackers to cause a denial of service (crash) via certain queries, which cause an assertion failure.
  • CVE-2006-4574
    • Chain: security monitoring product has an off-by-one error that leads to unexpected length values, triggering an assertion.
CWE

CWE-618 – Exposed Unsafe ActiveX Method

Read Time:1 Minute, 1 Second

Description

An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser’s security model (e.g. the zone or domain).

ActiveX controls can exercise far greater control over the operating system than typical Java or javascript. Exposed methods can be subject to various vulnerabilities, depending on the implemented behaviors of those methods, and whether input validation is performed on the provided arguments. If there is no integrity checking or origin validation, this method could be invoked by attackers.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-749

 

Consequences

Other: Other

 

Potential Mitigations

Phase: Implementation

Description: 

If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.

Phase: Architecture and Design

Description: 

Use code signing, although this does not protect against any weaknesses that are already in the control.

Phase: Architecture and Design, System Configuration

Description: 

Where possible, avoid marking the control as safe for scripting.

CVE References

  • CVE-2006-6838
    • control downloads and executes a url in a parameter