36 (Weakness Base)

see "Path Traversal" (CWE-22)

PLOVER - Absolute Path Traversal

All

349 (Weakness Base)

PLOVER - Untrusted Data Appended with Trusted Data

All

87 (Weakness Variant)

Resolve all filtered input to absolute or canonical representations before processing.

Carefully check each input parameter against a rigorous positive specification (white list) defining the specific characters and format allowed. All input should be sanitized, not just parameters that the user is supposed to specify, but all data in the request, including tag attributes, hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. We often encounter data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended.

This involves "HTML Entity Encoding" all non-alphanumeric characters from data that was received from the user and is now being written to the request.

With Struts, you should write all data from form beans with the bean's filter attribute set to true.

Additionally, to help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as Internet Explorer), this attribute prevents the user's session cookie from being accessed by client-side scripts, including scripts inserted due to a XSS attack.

PLOVER - Alternate XSS syntax

All

670 (Weakness Class)

This issue typically appears in rarely-tested code, since the "always-incorrect" nature will be detected as a bug during normal usage.

This node could possibly be split into lower-level nodes. "Early Return" is for returning control to the caller too soon (e.g., CWE-584). "Excess Return" is when control is returned too far up the call stack (CWE-600, CWE-395). "Improper control limitation" occurs when the product maintains control at a lower level of execution, when control should be returned "further" up the call stack (CWE-455). "Incorrect syntax" covers code that's "just plain wrong" such as CWE-484 and CWE-483.

88 (Weakness Base)

Primary (Weakness exists independent of other weaknesses)

Explicit (This is an explicit weakness resulting from behavior of the developer)

System Process

Avoid using user-controlled input in command arguments.

Assume all input is malicious. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system.

At one layer of abstraction, this can overlap other weaknesses that have whitespace problems, e.g. injection of javascript into attributes of HTML tags.

Fault: unquoted special characters, input restriction error, unquoted special terms, whitespace

PLOVER - Argument Injection or Modification

All

582 (Weakness Variant)

Primary (Weakness exists independent of other weaknesses)

In most situations the array should be made private.

The following Java Applet code mistakenly declares an array public, final and static.

Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed on a remote machine. Because mobile code developers have little if any control of the environment in which their code will execute, special security concerns become relevant. One of the biggest environmental threats results from the risk that the mobile code will run side-by-side with other, potentially malicious, mobile code. Because all of the popular web browsers execute code from multiple sources together in the same JVM, many of the security guidelines for mobile code are focused on preventing manipulation of your objects' state and behavior by adversaries who have access to the same virtual machine where your program is running.

In most cases an array declared public, final and static is a bug.

Java

11 (Weakness Variant)

Avoid releasing debug binaries into the production environment.

ASP .NET applications can be configured to produce debug binaries. These binaries give detailed debugging messages and should not be used in production environments. The debug attribute of the tag defines whether compiled binaries should include debugging information. The use of debug binaries causes an application to provide as much information about itself as possible to the user. Debug binaries are meant to be used in a development or testing environment and can pose a security risk if they are deployed to production. Attackers can leverage the additional information they gain from debugging output to mount attacks targeted on the framework, database, or other resources used by the application.

7 Pernicious Kingdoms - ASP.NET Misconfiguration: Creating Debug Binary

.NET

12 (Weakness Variant)

Handle exceptions appropriately in source code.

Do not attempt to process an error or attempt to mask it.

Verify return values are correct and do not supply sensitive information about the system.

ASP .NET applications should be configured to use custom error pages instead of the framework default page. The default error page gives detailed information about the error that occurred, and should not be used in production environments. The mode attribute of the tag defines whether custom or default error pages are used. Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.

7 Pernicious Kingdoms - ASP.NET Misconfiguration: Missing Custom Error Handling

.NET

554 (Weakness Class)

Use the ASP.NET validation framework to check all program input before it is processed by the application. Example uses of the validation framework include checking to ensure that: - Phone number fields contain only valid characters in phone numbers - Boolean values are only "T" or "F" - Free-form strings are of a reasonable length and composition

In certain versions of ASP.Net, there is an input validation error that allows a malicious user to input some ASCII characters in a special Unicode encoding in the range ff00 to ff60. When the response encoding is not Unicode, these characters are decoded to their ASCII values, and this way can be used to launch cross site scripting attacks. The relevant Unicode strings are %uff1c, which is decoded to <, and %uff1e, which is decoded to >.

Anonymous Tool Vendor (under NDA) -

.NET

13 (Weakness Variant)

Good password management guidelines require that a password never be stored in plaintext.

7 Pernicious Kingdoms - ASP.NET Misconfiguration: Password in Configuration File

481 (Weakness Variant)

Low

Pre-design: Through Build: Many IDEs and static analysis products will detect this problem.

Implementation: Place constants on the left. If one attempts to assign a constant with a variable, the compiler will of course produce an error.

This bug is generally as a result of a typo and usually should cause obvious problems with program execution. If the comparison is in an if statement, the if statement will always return the value of the right-hand side variable.

CLASP - Assigning instead of comparing

C

C++

Java

.NET

587 (Weakness Base)

Primary (Weakness exists independent of other weaknesses)

Implementation: Never set a pointer to a fixed address.

C Example:

Consequence: Integrity: If one executes code at a known location, one might be able to inject code there beforehand.

Consequence: Confidentiality: The data at a known pointer location can be easily read.

Most often, this issue will only result in a crash, but in circumstances where a user can influence the data at which the pointer points to, it may result in code execution. At best, using fixed addresses is not portable.

C

C++

C#

Assembly

593 (Weakness Variant)

Authentication: no authentication takes place in this process, bypassing an assumed protection of encryption

Confidentiality: the encrypted communication between a user and a trusted host may be subject to a "man in the middle" sniffing attack

Design: Use a language which provides a cryptography framework at a higher level of abstraction.

Implementation: Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.

C Example:

Applications should set up an SSL_CTX completely, before creating SSL objects from it.If one did modify the SSL_CTX object after creating objects from it, there is the possibility that older SSL objects created from that context could all be affected by that change.