Business Logic Errors

Opis

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Wpisy w tej grupie

• CWE-283 Unverified Ownership
• CWE-639 Authorization Bypass Through User-Controlled Key
• CWE-640 Weak Password Recovery Mechanism for Forgotten Password
• CWE-708 Incorrect Ownership Assignment
• CWE-770 Allocation of Resources Without Limits or Throttling
• CWE-826 Premature Release of Resource During Expected Lifetime
• CWE-837 Improper Enforcement of a Single, Unique Action
• CWE-841 Improper Enforcement of Behavioral Workflow

Uwagi

<xhtml:p>The "Business Logic" term is generally used to describe issues that require domain-specific knowledge or "business rules" to determine if they are weaknesses or vulnerabilities, instead of legitimate behavior. Such issues might not be easily detectable via automatic code analysis, because the associated operations do not produce clear errors or undefined behavior at the code level. However, many such "business logic" issues can be understood as instances of other weaknesses such as input validation, access control, numeric computation, order of operations, etc.</xhtml:p>

<xhtml:p>The classification of business logic flaws has been under-studied, although exploitation of business flaws frequently happens in real-world systems, and many applied vulnerability researchers investigate them. The greatest focus is in web applications. There is debate within the community about whether these problems represent particularly new concepts, or if they are variations of well-known principles.</xhtml:p> <xhtml:p>Many business logic flaws appear to be oriented toward business processes, application flows, and sequences of behaviors, which are not as well-represented in CWE as weaknesses related to input validation, memory management, etc.</xhtml:p>

Źródła