CODE LAB

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Off-by-one Error

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy for that actor.

Allocation of Resources Without Limits or Throttling

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Array Index Underflow

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Authentication Bypass Using an Alternate Path or Channel

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

Brute Force

The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Buffer Over-read

The software writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Buffer Underflow

The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

Buffer Under-read

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application.

Business Logic Errors

The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Classic Buffer Overflow

The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Cleartext Storage of Sensitive Information

The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Cleartext Transmission of Sensitive Information

The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Client-Side Enforcement of Server-Side Security

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Code Injection

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Command Injection - Generic

The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

CRLF Injection

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Cross-Site Request Forgery (CSRF)

In DOM-based XSS, the client performs the injection of XSS into the page; in the other types, the server performs the injection. DOM-based XSS generally involves server-controlled, trusted script that is sent to the client, such as Javascript that performs sanity checks on a form before the user submits it. If the server-supplied script processes user-supplied data and then injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is possible.

Cross-site Scripting (XSS) - DOM

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Cross-site Scripting (XSS) - Generic

The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.

Cross-site Scripting (XSS) - Reflected

The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. For example, the attacker might inject XSS into a log message, which might not be handled properly when an administrator views the logs.

Cross-site Scripting (XSS) - Stored

Weaknesses in this category are related to the use of cryptography.

Cryptographic Issues - Generic

The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

Denial of Service

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Deserialization of Untrusted Data

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Double Free

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Download of Code Without Integrity Check

The application contains code that appears to be malicious in nature.

Embedded Malicious Code

The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Execution with Unnecessary Privileges

The software provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Exposed Dangerous Method or Function

The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.

External Control of Critical State Data

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Externally Controlled Reference to a Resource in Another Sphere

The software does not adequately filter user-controlled input for special elements with control implications.

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere.

File and Directory Information Exposure

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Forced Browsing

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Heap Overflow

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.

HTTP Request Smuggling

The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

HTTP Response Splitting

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Improper Access Control - Generic

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Improper Authentication - Generic

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Improper Authorization

The software does not validate, or incorrectly validates, a certificate.

Improper Certificate Validation

The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.

Improper Check or Handling of Exceptional Conditions

The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Improper Control of Interaction Frequency

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Improper Export of Android Application Components

The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Improper Following of a Certificate's Chain of Trust

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Improper Handling of Highly Compressed Data (Data Amplification)

The application does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the application in an invalid state.

Improper Handling of Insufficient Permissions or Privileges

The software does not properly handle when all or part of an input has been URL encoded.

Improper Handling of URL Encoding (Hex Encoding)

The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

Improper Input Validation

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Improper Neutralization of Escape, Meta, or Control Sequences

The application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Improper Neutralization of HTTP Headers for Scripting Syntax

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Improper Neutralization of Special Elements

The software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Improper Null Termination

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Improper Privilege Management

The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Inadequate Encryption Strength

The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Inclusion of Functionality from Untrusted Control Sphere

An application uses a "blacklist" of prohibited values, but the blacklist is incomplete.

Incomplete Blacklist

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Incorrect Authorization

The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Incorrect Calculation of Buffer Size

The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Incorrect Comparison

The software creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Incorrectly Specified Destination in a Communication Channel

The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Incorrect Permission Assignment for Critical Resource

An information disclosure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.

Information Disclosure

The software generates an error message that includes sensitive information about its environment, users, or associated data.

Information Exposure Through an Error Message

The application contains debugging code that can expose sensitive information to untrusted parties.

Information Exposure Through Debug Information

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

Information Exposure Through Directory Listing

The product behaves differently or sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Information Exposure Through Discrepancy

The accidental exposure of sensitive information through sent data refers to the transmission of data which are either sensitive in and of itself or useful in the further exploitation of the system through standard data channels.

Information Exposure Through Sent Data

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Information Exposure Through Timing Discrepancy

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Insecure Direct Object Reference (IDOR)

The software stores sensitive information without properly limiting read or write access by unauthorized actors.

Insecure Storage of Sensitive Information

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Insecure Temporary File

This weakness occurs when the application transmits or stores authentication credentials and uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Insufficiently Protected Credentials

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Insufficient Session Expiration

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Insufficient Verification of Data Authenticity

The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Integer Overflow

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Integer Underflow

The software performs a key exchange with an actor without verifying the identity of that actor.

Key Exchange without Entity Authentication

The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Reliance on Untrusted Inputs in a Security Decision

A lack of binary protections within a mobile app exposes the application and it’s owner to a large variety of technical and business risks if the underlying application is insecure or exposes sensitive intellectual property. A lack of binary protections results in a mobile app that can be analyzed, reverse-engineered, and modified by an adversary in rapid fashion. An adversary will use an automated tool to reverse engineer the code and modify it using malware to perform some hidden functionality.

Lack of Binary Hardening

The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

LDAP Injection

The application was deployed with active debugging code that can create unintended entry points.

Leftover Debug Code (Backdoor)

An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact.

Malware

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Man-in-the-Middle

The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Memory Corruption - Generic

Weakness typically introduced during the configuration of the software.

Misconfiguration

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Missing Authentication for Critical Function

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Missing Authorization

The software implements an authentication technique, but it skips a step that weakens the technique.

Missing Critical Step in Authentication

The software does not encrypt sensitive or critical information before storage or transmission.

Missing Encryption of Sensitive Data

The software does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by that algorithm.

Missing Required Cryptographic Step

The software does not properly protect an assumed-immutable element from being modified by an attacker.

Modification of Assumed-Immutable Data (MAID)

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

NULL Pointer Dereference

The application does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Omission of Security-relevant Information

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Open Redirect

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

OS Command Injection

The software reads data past the end, or before the beginning, of the intended buffer.

Out-of-bounds Read

The software stores a password in a configuration file that might be accessible to actors who do not know the password.

Trustline Vulnerability Disclosure Program

by Trustline

Reporter data

Report Title*

Weakness*

Proof Of Concept