Common flaws reported by Tools while doing Static Code Analysis
Below are the most common vulnerabilities reported by SAST tools like Veracode, Fortify, IBM Appscan Source and Checkmarx.
Critical/ High
- SQL Injection
- Directory Traversal
- Cross-Site Scripting (XSS)
- Insufficient Input Validation
- CRLF Injection
- Time and State
- Session Fixation
- Code Quality
- Encapsulation
- Information Leakage
- API Abuse
- Cryptographic Issues
- Credentials Management
- Command or Argument Injection
- Untrusted Search Path
- Untrusted Initialization
- Potential Backdoor
- Server Configuration
- Buffer Overflow
- Dangerous Functions
- Numeric Errors
- Error Handling
- Buffer Management Errors
- Race Conditions
- Insecure Dependencies
- Deployment Configuration
- Authentication Issues
- Code Injection
- Format String
- Authorization Issues
Medium
- Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
- Process Control
- Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
- External Control of File Name or Path
- Improper Output Neutralization for Logs
- Plaintext Storage of a Password
- Cleartext Storage of Sensitive Information in Memory
- Insufficient Entropy
- Unchecked Error Condition
- Improper Resource Shutdown or Release
- Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’)
- Use of Hard-coded Password
- Insecure Temporary File
- Improper Restriction of XML External Entity Reference (‘XXE’)
- Information Exposure Through Sent Data
- Use of Externally-Controlled Format String
- Embedded Malicious Code
- Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’)
- Unintended Proxy or Intermediary (‘Confused Deputy’)
- Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)
- URL Redirection to Untrusted Site (‘Open Redirect’)
- Information Exposure Through an Error Message
- External Control of System or Configuration Setting
- Uncontrolled Search Path Element
- Use of a Broken or Risky Cryptographic Algorithm
- Use After Free
- Technology-Specific Input Validation Problems
- Improperly Controlled Modification of Dynamically-Determined Object Attributes
- Numeric Truncation Error
- Integer Underflow (Wrap or Wraparound)
- Signed to Unsigned Conversion Error
- Use of Inherently Dangerous Function
- Cleartext Transmission of Sensitive Information
- Protection Mechanism Failure
- Improper Following of a Certificate’s Chain of Trust
- Inadequate Encryption Strength
- Selection of Less-Secure Algorithm During Negotiation (‘Algorithm Downgrade’)
- Information Exposure Through Environmental Variables
- Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
- Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’)
- Transmission of Private Resources into a New Sphere (‘Resource Leak’)
- Struts: Incomplete validate() Method Definition
- Struts: Form Bean Does Not Extend Validation Class
- Use of Hard-coded Cryptographic Key
- Race Condition within a Thread
- Leftover Debug Code
- Trust Boundary Violation
- J2EE Bad Practices: Direct Management of Connections
- Improper Verification of Cryptographic Signature
- J2EE Bad Practices: Use of System.exit()
- Use of Wrong Operator in String Comparison
- Stack-based Buffer Overflow
- Integer Overflow or Wraparound
- Argument Injection or Modification
- Improper Validation of Array Index
- Improper Null Termination
- Unsigned to Signed Conversion Error
- Failure to Handle Missing Parameter
- Out-of-bounds Read
- Missing Encryption of Sensitive Data
- Time-of-check Time-of-use (TOCTOU) Race Condition
- Improper Validation of Certificate with Host Mismatch
- Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
- Cross-Site Request Forgery (CSRF)
- Insufficiently Protected Credentials
- Incorrect Ownership Assignment
Low
- Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
- External Control of File Name or Path
- Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Improper Output Neutralization for Logs
- Use of Hard-coded Password
- Use of a Broken or Risky Cryptographic Algorithm
- Insufficient Entropy
- Insecure Temporary File
- Uncontrolled Search Path Element
- Unintended Proxy or Intermediary (‘Confused Deputy’)
- Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)
- URL Redirection to Untrusted Site (‘Open Redirect’)
- Improper Restriction of XML External Entity Reference (‘XXE’)
- Information Exposure Through Sent Data
- Information Exposure Through an Error Message
- Improper Resource Shutdown or Release
- External Control of System or Configuration Setting
- Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
- Cleartext Storage of Sensitive Information in Memory
- Technology-Specific Input Validation Problems
- Improper Following of a Certificate’s Chain of Trust
- Insufficiently Protected Credentials
- Protection Mechanism Failure
- Selection of Less-Secure Algorithm During Negotiation (‘Algorithm Downgrade’)
- Information Exposure Through Environmental Variables
- Embedded Malicious Code
- Unchecked Error Condition
- Process Control
- Struts: Form Bean Does Not Extend Validation Class
- Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’)
- Use of Hard-coded Cryptographic Key
- Leftover Debug Code
- Trust Boundary Violation
- J2EE Bad Practices: Direct Management of Connections
- J2EE Bad Practices: Use of System.exit()
- Use of Wrong Operator in String Comparison
- Plaintext Storage of a Password
- Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
- Struts: Incomplete validate() Method Definition
- Deserialization of Untrusted Data
- Improper Neutralization of Script in Attributes in a Web Page
- Improper Validation of Certificate with Host Mismatch
- Exposure of Resource to Wrong Sphere
- Cross-Site Request Forgery (CSRF)
- Transmission of Private Resources into a New Sphere (‘Resource Leak’)
About Author:
Suman Tiwari is a Cyber Security Professional by Profession and photographer by passion.
His Linkedin profile can be visited here for more details.