The product downloads source code or an executable from a
remote location and executes the code without sufficiently verifying the origin
and integrity of the code.
Extended Description
An attacker can execute malicious code by compromising the host server,
performing DNS spoofing, or modifying the code in transit.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Availability
Executing untrusted code could result in a compromise of the
application and failure to function correctly for users.
Confidentiality
If an attacker can influence the untrusted code then, upon execution,
it may provide the attacker with access to sensitive files.
Integrity
Executing untrusted code could compromise the control flow of the
program, possibly also leading to the modification of sensitive
resources.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
(Bad Code)
Java
URL[] classURLs= new URL[]{
new URL("file:subdir/")
};
URLClassLoader loader = new URLClassLoader(classURLs);
Class loadedClass = Class.forName("loadMe", true, loader);
VOIP phone downloads applications from web sites
without verifying integrity.
Potential Mitigations
Phase
Description
Implementation
Perform proper forward and reverse DNS lookups to detect DNS spoofing.
This is only a partial solution since it will not prevent your code from
being modified on the hosting site or in transit.
Architecture and Design
Operation
Encrypt the code with a reliable encryption scheme before
transmitting.
This will only be a partial solution, since it will not detect DNS
spoofing and it will not prevent your code from being modified on the
hosting site.
Architecture and Design
Use integrity checking on the transmitted code.
If you are providing the code that is to be downloaded, such as
for automatic updates of your software, then use cryptographic
signatures for your code and modify your download clients to verify
the signatures. Ensure that your implementation does not contain
CWE-295, CWE-320, CWE-347, and related weaknesses.
Use code signing technologies such as Authenticode. See
references.
Testing
Use tools and techniques that require manual (human) analysis, such as
penetration testing, threat modeling, and interactive tools that allow
the tester to record and modify an active session. These may be more
effective than strictly automated techniques. This is especially the
case with weaknesses that are related to design and business
rules.
Testing
Use monitoring tools that examine the software's process as it
interacts with the operating system and the network. This technique is
useful in cases when source code is unavailable, if the software was not
developed by you, or if you want to verify that the build phase did not
introduce any new weaknesses. Examples include debuggers that directly
attach to the running process; system-call tracing utilities such as
truss (Solaris) and strace (Linux); system activity monitors such as
FileMon, RegMon, Process Monitor, and other Sysinternals utilities
(Windows); and sniffers and protocol analyzers that monitor network
traffic.
Attach the monitor to the process and also sniff the network
connection. Trigger features related to product updates or plugin
installation, which is likely to force a code download. Monitor when
files are downloaded and separately executed, or if they are otherwise
read back into the process. Look for evidence of cryptographic library
calls that use integrity checking.
This is critical for mobile code, but it is likely to become more and more
common as developers continue to adopt automated, network-based product
distributions and upgrades. Software-as-a-Service (SaaS) might introduce
additional subtleties. Common exploitation scenarios may include ad server
compromises and bad upgrades.
updated Relationships, Other Notes,
Taxonomy Mappings
2009-01-12
CWE Content Team
MITRE
Internal
updated Applicable Platforms, Common Consequences,
Description, Name, Other Notes, Potential Mitigations, References,
Relationships, Research Gaps, Type
2009-03-10
CWE Content Team
MITRE
Internal
updated Potential Mitigations
2009-07-27
CWE Content Team
MITRE
Internal
updated Description, Observed Examples,
Related Attack Patterns
Description
