Description
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
This weakness can lead to a wide variety of resultant weaknesses, depending on the behavior of the exposed method. It can apply to any number of technologies and approaches, such as ActiveX controls, Java functions, IOCTLs, and so on. The exposure can occur in a few different ways:
Potential Impact
Integrity, Confidentiality, Availability, Access Control, Other
Gain Privileges or Assume Identity, Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Other
Demonstrative Examples
public void removeDatabase(String databaseName) {
try {
Statement stmt = conn.createStatement();stmt.execute("DROP DATABASE " + databaseName);
} catch (SQLException ex) {...}
}private void removeDatabase(String databaseName) {
try {
Statement stmt = conn.createStatement();stmt.execute("DROP DATABASE " + databaseName);
} catch (SQLException ex) {...}}// Android
@Overridepublic boolean shouldOverrideUrlLoading(WebView view, String url){
if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){writeDataToView(view, UserData);return false;}else{return true;}}
}// iOS
-(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType{
NSURL *URL = [exRequest URL];if ([[URL scheme] isEqualToString:@"exampleScheme"]){
NSString *functionString = [URL resourceSpecifier];if ([functionString hasPrefix:@"specialFunction"]){
// Make data available back in webview.
UIWebView *webView = [self writeDataToView:[URL query]];
}return NO;
}return YES;
}window.location = examplescheme://method?parameter=valuepublic class WebViewGUI extends Activity {
WebView mainWebView;
public void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);mainWebView = new WebView(this);mainWebView.getSettings().setJavaScriptEnabled(true);mainWebView.addJavascriptInterface(new JavaScriptInterface(), "userInfoObject");mainWebView.loadUrl("file:///android_asset/www/index.html");setContentView(mainWebView);}
final class JavaScriptInterface {
JavaScriptInterface () {}
public String getUserInfo() {return currentUser.Info();}
}
}<script>userInfoObject.getClass().forName('android.telephony.SmsManager').getMethod('getDefault',null).sendTextMessage(attackNumber, null, attackMessage, null, null);</script>final class JavaScriptInterface {
JavaScriptInterface () { }
@JavascriptInterfacepublic String getUserInfo() {return currentUser.Info();}
}<script>var info = window.userInfoObject.getUserInfo();sendUserInfo(info);</script>Mitigations & Prevention
If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be: Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2007-6382 | arbitrary Java code execution via exposed method |
| CVE-2007-1112 | security tool ActiveX control allows download or upload of files |
Related Weaknesses
Frequently Asked Questions
What is CWE-749?
CWE-749 (Exposed Dangerous Method or Function) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not proper...
How can CWE-749 be exploited?
Attackers can exploit CWE-749 (Exposed Dangerous Method or Function) to gain privileges or assume identity, read application data, modify application data, execute unauthorized code or commands, other. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-749?
Key mitigations include: If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
What is the severity of CWE-749?
CWE-749 is classified as a Base-level weakness (Medium abstraction). It has been observed in 2 real-world CVEs.