1568
Example Language: JavaScript (Attack)
<script>
var info = window.userInfoObject.getUserInfo();
sendUserInfo(info);
</script>
This malicious code within an iframe is able to access the interface object and steal the user's data.
Observed Examples
Reference Description
CVE-2007-6382 arbitrary Java code execution via exposed method
https://www.cve.org/CVERecord?id=CVE-2007-6382
CVE-2007-1112 security tool ActiveX control allows download or upload of files
https://www.cve.org/CVERecord?id=CVE-2007-1112
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Research Gap
Under-reported and under-studied. This weakness could appear in any technology, language, or
framework that allows the programmer to provide a functional interface to external parties, but
it is not heavily reported. In 2007, CVE began showing a notable increase in reports of exposed
method vulnerabilities in ActiveX applications, as well as IOCTL access to OS-level resources.
These weaknesses have been documented for Java applications in various secure programming
sources, but there are few reports in CVE, which suggests limited awareness in most parts of the
vulnerability research community.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
500 WebView Injection
References
[REF-503]Microsoft. "Developing Secure ActiveX Controls". 2005 April 3. < https://
learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN
>.2023-04-07.
[REF-510]Microsoft. "How to stop an ActiveX control from running in Internet Explorer". < https://
support.microsoft.com/en-us/help/240797/how-to-stop-an-activex-control-from-running-in-internetexplorer
>.2023-04-07.
CWE-754: Improper Check for Unusual or Exceptional Conditions
Weakness ID : 754
Structure : Simple
Abstraction : Class
Description
CWE Version 4.14
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-754: Improper Check for Unusual or Exceptional Conditions