1748
The product includes web functionality (such as a web widget) from another domain, which causes
it to operate within the domain of the product, potentially granting total access and control of the
product to the untrusted source.
Extended Description
Including third party functionality in a web-based environment is risky, especially if the source of the
functionality is untrusted.
Even if the third party is a trusted source, the product may still be exposed to attacks and malicious
behavior if that trusted source is compromised, or if the code is modified in transmission from the
third party to the product.
This weakness is common in "mashup" development on the web, which may include source
functionality from other domains. For example, Javascript-based web widgets may be inserted
by using '<SCRIPT SRC="http://other.domain.here">' tags, which causes the code to run in the
domain of the product, not the remote site from which the widget was loaded. As a result, the
included code has access to the local DOM, including cookies and other data that the developer
might not want the remote site to be able to access.
Such dependencies may be desirable, or even required, but sometimes programmers are not
aware that a dependency exists.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 829 Inclusion of Functionality from Untrusted Control Sphere 1741
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1016 Limit Exposure 2431
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
Demonstrative Examples
Example 1:
This login webpage includes a weather widget from an external website:
Example Language: HTML (Bad)
<div class="header"> Welcome!
<div id="loginBox">Please Login:
<form id ="loginForm" name="loginForm" action="login.php" method="post">
Username: <input type="text" name="username" />
<br/>
Password: <input type="password" name="password" />
<input type="submit" value="Login" />
</form>
</div>
CWE Version 4.14
CWE-831: Signal Handler Function Associated with Multiple Signals
CWE-831: Signal Handler Function Associated with Multiple Signals