#4
A04:2021
Insecure Design
Insecure design is a broad category representing different weaknesses, expressed as missing or ineffective control design. This is distinct from implementation flaws.
概述
A new category for 2021 focuses on risks related to design and architectural flaws, with a call for more use of threat modeling, secure design patterns, and reference architectures.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Business logic bypass
Application flows can be circumvented because the design didn't account for all possible user paths or state transitions.
检测信号:
Users completing processes in unexpected order, missing validation at critical steps
Missing rate limiting
Sensitive operations like password reset or account creation lack rate limits, enabling automated attacks.
检测信号:
High volume of requests to sensitive endpoints from single sources
如何预防
- Establish a secure development lifecycle with security professionals
- Use threat modeling for critical authentication and access control
- Integrate security language and controls into user stories
- Write unit and integration tests to validate security controls
- Segregate tier layers based on exposure and protection needs
- Limit resource consumption by user or service
有Shoulder检测的CWE (8)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
CWE-209
5 规则
Generation of Error Message Containing Sensitive Information
go, javascript, typescript, python
CWE-434
3 规则
Unrestricted Upload of File with Dangerous Type
go, javascript, typescript, python
CWE-840
3 规则
Business Logic Errors
go, javascript, typescript, python
CWE-235
2 规则
Improper Handling of Extra Parameters
javascript, typescript, python
CWE-269
2 规则
Improper Privilege Management
python
CWE-444
1 规则
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
python
CWE-598
1 规则
Use of GET Request Method With Sensitive Query Strings
python
CWE-807
1 严重
1 规则
Reliance on Untrusted Inputs in a Security Decision
python
其他映射的CWE (32)
这些CWE映射到此类别，但尚无Shoulder规则。
CWE-73
CWE-73
CWE-183
CWE-183
CWE-213
CWE-213
CWE-256
CWE-256
CWE-257
CWE-257
CWE-266
CWE-266
CWE-280
CWE-280
CWE-311
Missing Encryption of Sensitive Data
CWE-312
CWE-312
CWE-313
CWE-313
CWE-316
CWE-316
CWE-419
CWE-419
CWE-430
CWE-430
CWE-451
CWE-451
CWE-472
CWE-472
CWE-501
CWE-501
CWE-522
Insufficiently Protected Credentials
CWE-525
CWE-525
CWE-539
CWE-539
CWE-579
CWE-579
CWE-602
CWE-602
CWE-642
CWE-642
CWE-646
CWE-646
CWE-650
CWE-650
CWE-653
CWE-653
CWE-656
CWE-656
CWE-657
CWE-657
CWE-799
CWE-799
CWE-841
CWE-841
CWE-927
CWE-927
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
CWE-1173
CWE-1173