244
Nature Type ID Name Page
PeerOf 706 Use of Incorrectly-Resolved Name or Reference 1544
CanAlsoBe 73 External Control of File Name or Path 132
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Insecure Direct Object Reference : OWASP uses this term, although it is effectively the same as
resource injection.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
Read Files or Directories
Modify Files or Directories
An attacker could gain access to or modify sensitive data
or system resources. This could allow access to protected
files or directories including configuration files and files
containing sensitive information.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
CWE Version 4.14
CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
CWE-99: Improper Control of Resource Identifiers ('Resource Injection')