Use of Multiple Resources with Duplicate Identifier

Opis

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.

Skutki

• Access Control

  Bypass Protection Mechanism

  If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.

• Other

  Quality Degradation

Zapobieganie

• Architecture and Design

  Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

Przykłady podatności

• CVE-2013-4787 chain: mobile OS verifies cryptographic signature of file in an archive, but then installs a different file with the same name that is also listed in the archive.

Słabość nadrzędna

• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
• CWE-573 Improper Following of Specification by Caller

Słabości podrzędne

• CWE-102 Struts: Duplicate Validation Forms
• CWE-462 Duplicate Key in Associative List (Alist)

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Uwagi

This weakness is probably closely associated with other issues related to doubling, such as CWE-675 (Duplicate Operations on Resource). It's often a case of an API contract violation (CWE-227).