1210
[REF-467]Nelson Elhage. "Exploiting misuse of Python's "pickle"". 2011 March 0. < https://
blog.nelhage.com/2011/03/exploiting-pickle/ >.
[REF-468]Chris Frohoff. "Deserialize My Shorts: Or How I Learned to Start Worrying and Hate Java
Object Deserialization". 2016 March 1. < https://speakerdeck.com/frohoff/owasp-sd-deserialize-myshorts-
or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization >.2023-04-07.
CWE-506: Embedded Malicious Code
Weakness ID : 506
Structure : Simple
Abstraction : Class
Description
The product contains code that appears to be malicious in nature.
Extended Description
Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and
logic-bomb. A developer might insert malicious code with the intent to subvert the security of a
product or its host system at some time in the future. It generally refers to a program that performs
a useful service but exploits rights of the program's user in a way the user does not intend.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 912 Hidden Functionality 1803
ParentOf 507 Trojan Horse 1212
ParentOf 510 Trapdoor 1215
ParentOf 511 Logic/Time Bomb 1216
ParentOf 512 Spyware 1218
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
Detection Methods
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies Generated Code Inspection
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Automated Monitored Execution
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
CWE Version 4.14
CWE-506: Embedded Malicious Code
CWE-506: Embedded Malicious Code