1172
Indirect :
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Alternate Terms
Leftover debug code : This term originates from Seven Pernicious Kingdoms
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Other
Bypass Protection Mechanism
Read Application Data
Gain Privileges or Assume Identity
Varies by Context
The severity of the exposed debug application will depend
on the particular instance. At the least, it will give an
attacker sensitive information about the settings and
mechanics of web applications on the server. At worst,
as is often the case, the debug application will allow an
attacker complete control over the web application and
server, as well as confidential information that either of
these access.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Build and Compilation
Phase: Distribution
Remove debug code before deploying the application.
Demonstrative Examples
Example 1:
Debug code can be used to bypass authentication. For example, suppose an application has
a login script that receives a username and a password. Assume also that a third, optional,
parameter, called "debug", is interpreted by the script as requesting a switch to debug mode, and
that when this parameter is given the username and password are not checked. In such a case,
it is very simple to bypass the authentication process if the special behavior of the application
regarding the debug parameter is known. In a case where the form is:
Example Language: HTML (Bad)
<FORM ACTION="/authenticate_login.cgi">
CWE Version 4.14
CWE-489: Active Debug Code
CWE-489: Active Debug Code