1484
Scope Impact Likelihood
Other Other
Demonstrative Examples
Example 1:
Consider a blog publishing tool, which might have three explicit control spheres: the creation of
articles, only accessible to a "publisher;" commenting on articles, only accessible to a "commenter"
who is a registered user; and reading articles, only accessible to an anonymous reader. Suppose
that the application is deployed on a web server that is shared with untrusted parties. If a local
user can modify the data files that define who a publisher is, then this user has modified the control
sphere. In this case, the issue would be resultant from another weakness such as insufficient
permissions.
Example 2:
In Untrusted Search Path (CWE-426), a user might be able to define the PATH environment
variable to cause the product to search in the wrong directory for a library to load. The product's
intended sphere of control would include "resources that are only modifiable by the person who
installed the product." The PATH effectively changes the definition of this sphere so that it overlaps
the attacker's sphere of control.
Observed Examples
Reference Description
CVE-2008-2613 setuid program allows compromise using path that finds and loads a malicious
library.
https://www.cve.org/CVERecord?id=CVE-2008-2613
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Theoretical
A "control sphere" is a set of resources and behaviors that are accessible to a single actor,
or a group of actors. A product's security model will typically define multiple spheres, possibly
implicitly. For example, a server might define one sphere for "administrators" who can create new
user accounts with subdirectories under /home/server/, and a second sphere might cover the set
of users who can create or delete files within their own subdirectories. A third sphere might be
"users who are authenticated to the operating system on which the product is installed." Each
sphere has different sets of actors and allowable behaviors.
CWE-674: Uncontrolled Recursion
Weakness ID : 674
Structure : Simple
Abstraction : Class
Description
CWE Version 4.14
CWE-674: Uncontrolled Recursion
CWE-674: Uncontrolled Recursion