1474
Additionally, the creation of the BufferedWriter object is subject to relative path traversal (CWE-23).
Since the code does not check the filename that is provided in the header, an attacker can use
"../" sequences to write to files outside of the intended directory. Depending on the executing
environment, the attacker may be able to specify arbitrary files to write to, leading to a wide variety
of consequences, from code execution, XSS (CWE-79), or system crash.
Example 2:
This code includes an external script to get database credentials, then authenticates a user against
the database, allowing access to the application.
Example Language: PHP (Bad)
//assume the password is already encrypted, avoiding CWE-312
function authenticate($username,$password){
include("http://external.example.com/dbInfo.php");
//dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available
mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');
mysql_select_db($dbname);
$query = 'Select * from users where username='.$username.' And password='.$password;
$result = mysql_query($query);
if(mysql_numrows($result) == 1){
mysql_close();
return true;
}
else{
mysql_close();
return false;
}
}
This code does not verify that the external domain accessed is the intended one. An attacker may
somehow cause the external domain name to resolve to an attack server, which would provide
the information for a false database. The attacker may then steal the usernames and encrypted
passwords from real user login attempts, or simply allow themself to access the application without
a real user account.
This example is also vulnerable to an Adversary-in-the-Middle AITM (CWE-300) attack.
Example 3:
This code either generates a public HTML user information page or a JSON response containing
the same user information.
Example Language: PHP (Bad)
// API flag, output JSON if set
$json = $_GET['json']
$username = $_GET['user']
if(!$json)
{
$record = getUserRecord($username);
foreach($record as $fieldName => $fieldValue)
{
if($fieldName == "email_address") {
// skip displaying user emails
continue;
}
else{
writeToHtmlPage($fieldName,$fieldValue);
}
}
}
else
{
$record = getUserRecord($username);
CWE Version 4.14
CWE-670: Always-Incorrect Control Flow Implementation
CWE-670: Always-Incorrect Control Flow Implementation