1381
Description
An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that
perform actions that are outside of the browser's security model (e.g. the zone or domain).
Extended Description
ActiveX controls can exercise far greater control over the operating system than typical Java
or javascript. Exposed methods can be subject to various vulnerabilities, depending on the
implemented behaviors of those methods, and whether input validation is performed on the
provided arguments. If there is no integrity checking or origin validation, this method could be
invoked by attackers.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 749 Exposed Dangerous Method or Function 1564
PeerOf 623 Unsafe ActiveX Control Marked Safe For Scripting 1389
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 275 Permission Issues 2317
Weakness Ordinalities
Primary :
Common Consequences
Scope Impact Likelihood
Other Other
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
If you must expose a method, make sure to perform input validation on all arguments, and
protect against all possible vulnerabilities.
Phase: Architecture and Design
Use code signing, although this does not protect against any weaknesses that are already in the
control.
Phase: Architecture and Design
Phase: System Configuration
CWE Version 4.14
CWE-619: Dangling Database Cursor ('Cursor Injection')
CWE-619: Dangling Database Cursor ('Cursor Injection')