Active Debug Code

Opis

The product is released with debugging code still enabled or active.

Inne nazwy

Leftover debug code

This term originates from Seven Pernicious Kingdoms

Skutki

• Confidentiality, Integrity, Availability, Access Control, Other

  Bypass Protection Mechanism; Read Application Data; Gain Privileges or Assume Identity; Varies by Context

  Active debug code can create unintended entry points or expose sensitive information. The severity of the exposed debug code will depend on the particular instance. At the least, it will give an attacker sensitive information about the settings and mechanics of web applications on the server. At worst, as is often the case, the debug code will allow an attacker complete control over the web application and server, as well as confidential information that either of these access.

Zapobieganie

• Build and Compilation, Distribution

  Remove debug code before deploying the application.

Przykłady podatności

• CVE-2024-44092 smartphone is built for production with debugging code present, allowing local privilege escalation
• CVE-2024-36475 network hub contains active debug code, which allows users to execute arbitrary OS commands using a debug function
• CVE-2024-29075 Mesh Wi-Fi router has active debug code, allowing attackers to modify device settings

Słabość nadrzędna

• CWE-710 Improper Adherence to Coding Standards

Może prowadzić do

• CWE-215 Insertion of Sensitive Information Into Debugging Code

Słabości podrzędne

• CWE-11 ASP.NET Misconfiguration: Creating Debug Binary

Kiedy powstaje

• Implementation — In web-based applications, debug code is used to test and modify web application properties, configuration information, and functions. If a debug application is left on a production server, this oversight during the "software process" allows attackers access to debug functionality.
• Implementation — A common development practice is to add "back door" code specifically designed for debugging or testing purposes that is not intended to be shipped or deployed with the product. These back door entry points create security risks because they are not considered during design or testing and fall outside of the expected operating conditions of the product.
• Build and Compilation
• Operation

Dotyczy

Not Language-Specific, Not Technology-Specific, ICS/OT

Uwagi

In J2EE a main method may be a good indicator that debug code has been left in the application, although there may not be any direct security impact.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005