#4
A04:2021
Insecure Design
Insecure design is a broad category representing different weaknesses, expressed as missing or ineffective control design. This is distinct from implementation flaws.
개요
A new category for 2021 focuses on risks related to design and architectural flaws, with a call for more use of threat modeling, secure design patterns, and reference architectures.
공격자가 이것을 악용하는 방법
공격 패턴을 이해하면 더 나은 방어를 구축하는 데 도움이 됩니다. 이것들은 보안 팀이 주시하는 기술입니다.
Business logic bypass
Application flows can be circumvented because the design didn't account for all possible user paths or state transitions.
탐지 신호:
Users completing processes in unexpected order, missing validation at critical steps
Missing rate limiting
Sensitive operations like password reset or account creation lack rate limits, enabling automated attacks.
탐지 신호:
High volume of requests to sensitive endpoints from single sources
예방 방법
- Establish a secure development lifecycle with security professionals
- Use threat modeling for critical authentication and access control
- Integrate security language and controls into user stories
- Write unit and integration tests to validate security controls
- Segregate tier layers based on exposure and protection needs
- Limit resource consumption by user or service
Shoulder 탐지가 있는 CWE (8)
이 CWE들은 Shoulder 탐지 규칙이 있습니다. 클릭하여 특정 취약점과 수정 사항을 확인하세요.
CWE-209
5 규칙
Generation of Error Message Containing Sensitive Information
go, javascript, typescript, python
CWE-434
3 규칙
Unrestricted Upload of File with Dangerous Type
go, javascript, typescript, python
CWE-840
3 규칙
Business Logic Errors
go, javascript, typescript, python
CWE-235
2 규칙
Improper Handling of Extra Parameters
javascript, typescript, python
CWE-269
2 규칙
Improper Privilege Management
python
CWE-444
1 규칙
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
python
CWE-598
1 규칙
Use of GET Request Method With Sensitive Query Strings
python
CWE-807
1 치명적
1 규칙
Reliance on Untrusted Inputs in a Security Decision
python
기타 매핑된 CWE (32)
이 CWE들은 이 카테고리에 매핑되어 있지만 아직 Shoulder 규칙이 없습니다.
CWE-73
CWE-73
CWE-183
CWE-183
CWE-213
CWE-213
CWE-256
CWE-256
CWE-257
CWE-257
CWE-266
CWE-266
CWE-280
CWE-280
CWE-311
Missing Encryption of Sensitive Data
CWE-312
CWE-312
CWE-313
CWE-313
CWE-316
CWE-316
CWE-419
CWE-419
CWE-430
CWE-430
CWE-451
CWE-451
CWE-472
CWE-472
CWE-501
CWE-501
CWE-522
Insufficiently Protected Credentials
CWE-525
CWE-525
CWE-539
CWE-539
CWE-579
CWE-579
CWE-602
CWE-602
CWE-642
CWE-642
CWE-646
CWE-646
CWE-650
CWE-650
CWE-653
CWE-653
CWE-656
CWE-656
CWE-657
CWE-657
CWE-799
CWE-799
CWE-841
CWE-841
CWE-927
CWE-927
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
CWE-1173
CWE-1173