The software provides an Applications Programming Interface
(API) or similar interface for interaction with external actors, but the
interface includes a dangerous method or function that is not properly
restricted.
Extended Description
This weakness can lead to a wide variety of resultant weaknesses,
depending on the behavior of the exposed method. It can apply to any number
of technologies and approaches, such as ActiveX controls, Java functions,
IOCTLs, and so on.
The exposure can occur in a few different ways:
1) The function/method was never intended to be exposed to outside
actors.
2) The function/method was only intended to be accessible to a limited
set of actors, such as Internet-based access from a single web
site.
security tool ActiveX control allows download or
upload of files
Potential Mitigations
Phase
Description
Architecture and Design
If you must expose a method, make sure to perform input validation on
all arguments, limit access to authorized parties, and protect against
all possible vulnerabilities.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Under-reported and under-studied. This weakness could appear in any
technology, language, or framework that allows the programmer to provide a
functional interface to external parties, but it is not heavily reported. In
2007, CVE began showing a notable increase in reports of exposed method
vulnerabilities in ActiveX applications, as well as IOCTL access to OS-level
resources. These weaknesses have been documented for Java applications in
various secure programming sources, but there are few reports in CVE, which
suggests limited awareness in most parts of the vulnerability research
community.
Description
