1

I've found a bug in some program that led to automatically opening URLs that were received from other users of the program.

However, while writing up a report on it, I realized that I didn't know the name of the vulnerability.

I am no cybersecurity expert, so I tried to look it up, and some search results I've got from CWE and OWASP were close but didn't quite match this.

What could it be?

  • depending on the process, was it stored in a db or flat file? then recalled with the code intact? Storing html code is not a vulnerability, but if you don't want that activity, you can change the text to html entities, that would not execute the code after it gets recalled. – drtechno Feb 24 at 18:29
4

What you've described is the impact of the vulnerability - a malicious URL being opened. If you're looking for a CWE, you're thinking about it from the wrong direction. CWEs describe weaknesses, which result in vulnerabilities, which result in potential impacts. Instead you should be considering how the vulnerability arose.

At a guess I'd say you're looking at some variant of 601 - Open Redirect, but that's a blind guess based on what you've said here.

  • 1
    That makes perfect sense, thank you for explaining it to me. – altskop Feb 24 at 2:05
  • 1
    Agreed Polynomial. It sounds like an open redirect, or...if you wanted to get even more technical @altskop, you could potentially say it’s like a forced redirect. It also sounds like it could, maybe, be simply an XSS vulnerability, though that’s just a guess based on what you’ve described. Polynomial is right - focus on the source of the behavior in order to effectively describe the vulnerability. And, welcome to the SE! – securityOrange Feb 24 at 4:02
0

That sounds more like a lack of implemented user confidentiality, meaning two users running a program can see each other's data (the URL). So - "loss of confidentiality" or "failure of user multi-tenancy" or "lack of application testing and security as part of software design" but not a traditional vulnerability in code.

  • I don't think this is correct. The application auto-opening a URL sent by another user isn't anything to do with confidentiality. It's more like an RCE really, but not quite. – Polynomial Feb 24 at 1:13
  • If the role of the application was to handle URLs sent by users then leaking the URL to another user is a loss of confidentiality. I guess I cannot fathom what purpose does "a URL sent by any user" serve. – HackneyB Feb 24 at 1:48
  • 1
    The bug here isn't that it leaks the URL to another user. It's that a malicious user can send a URL to another user that is automatically opened when they view the message. – Polynomial Feb 24 at 1:50
  • Agreed, I see what you mean. – HackneyB Feb 24 at 1:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.