Ejecuta análisis estático (SAST) sobre el código buscando el patrón inseguro en el flujo de datos.
CWE-669 Clase Borrador
Incorrect Resource Transfer Between Spheres
This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper…
Definición
What is CWE-669?
This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper transfer can give unintended actors control over that resource, leading to security breaches.
Think of your application as having separate, secure zones—like a user interface (client-side), a backend server, and an administrative panel. Each zone has its own level of trust and permitted actions. This weakness happens when a resource, such as a user session, a file handle, or an administrative function, is mistakenly allowed to cross from a less-trusted zone into a more-trusted one, or is imported without proper validation. For example, a web application might incorrectly accept and process a user-supplied file path as if it originated from the secure server itself, allowing an attacker to access sensitive system files.
To prevent this, developers must enforce strict boundaries between different spheres of control. Always validate and sanitize any resource that moves between contexts, explicitly check the origin of requests, and implement the principle of least privilege so that resources can only be used within their intended security scope. Auditing data flows and trust transitions in your architecture is key to identifying and fixing these improper transfers.
Impacto en el mundo real
Real-world CVEs caused by CWE-669
-
Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494).
-
PHP-based FAQ management app does not check the MIME type for uploaded images
-
Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error).
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
- 2
When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.
- 3
This code does not perform a check on the type of the file being uploaded (CWE-434). This could allow an attacker to upload any executable file or other file with malicious code.
- 4
Additionally, the creation of the BufferedWriter object is subject to relative path traversal (CWE-23). Since the code does not check the filename that is provided in the header, an attacker can use "../" sequences to write to files outside of the intended directory. Depending on the executing environment, the attacker may be able to specify arbitrary files to write to, leading to a wide variety of consequences, from code execution, XSS (CWE-79), or system crash.
- 5
This code includes an external script to get database credentials, then authenticates a user against the database, allowing access to the application.
Ejemplo de código vulnerable
Vulnerable Java
When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.
public class FileUploadServlet extends HttpServlet {
...
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.setContentType("text/html");
PrintWriter out = response.getWriter();
String contentType = request.getContentType();
// the starting position of the boundary header
int ind = contentType.indexOf("boundary=");
String boundary = contentType.substring(ind+9);
String pLine = new String();
String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value
// verify that content type is multipart form data
if (contentType != null && contentType.indexOf("multipart/form-data") != -1) {
// extract the filename from the Http header
BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
...
pLine = br.readLine();
String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));
...
// output the file to the local upload directory
try {
BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));
for (String line; (line=br.readLine())!=null; ) {
if (line.indexOf(boundary) == -1) {
bw.write(line);
bw.newLine();
bw.flush();
}
} //end of for loop
bw.close();
} catch (IOException ex) {...}
// output successful upload response HTML page
}
// output unsuccessful upload response HTML page
else
{...}
}
...
} Ejemplo de código seguro
Secure HTML
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
<form action="FileUploadServlet" method="post" enctype="multipart/form-data">
Choose a file to upload:
<input type="file" name="filename"/>
<br/>
<input type="submit" name="submit" value="Submit"/>
</form> What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-669
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Señales de detección
How to detect CWE-669
Ejecuta pruebas dinámicas de seguridad de aplicaciones (DAST) contra el endpoint en vivo.
Vigila los logs en tiempo de ejecución para detectar trazas de excepción inusuales, entradas malformadas o intentos de bypass de autorización.
Revisión de código: marca cualquier código nuevo que maneje entrada desde esta superficie sin usar los helpers validados del framework.
Plexicus detecta automáticamente CWE-669 y abre un PR de corrección en menos de 60 segundos.
Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.
Preguntas frecuentes ¿Qué es CWE-669?
¿Qué gravedad tiene CWE-669?
¿Qué lenguajes o plataformas se ven afectados por CWE-669?
¿Cómo puedo prevenir CWE-669?
¿Cómo detecta y corrige Plexicus CWE-669?
¿Dónde puedo aprender más sobre CWE-669?
Frequently asked questions
¿Qué es CWE-669?
This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper transfer can give unintended actors control over that resource, leading to security breaches.
¿Qué gravedad tiene CWE-669?
MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.
¿Qué lenguajes o plataformas se ven afectados por CWE-669?
MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.
¿Cómo puedo prevenir CWE-669?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
¿Cómo detecta y corrige Plexicus CWE-669?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-669 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-669?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/669.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-669
CWE-664 Padre
Improper Control of a Resource Through its Lifetime
This vulnerability occurs when software fails to properly manage a resource throughout its entire lifecycle—from creation and active use…
CWE-118 Hermano
Incorrect Access of Indexable Resource ('Range Error')
This vulnerability occurs when software fails to properly check the boundaries of an indexed resource, like an array, buffer, or file,…
CWE-1229 Hermano
Creation of Emergent Resource
This vulnerability occurs when a system's normal operations unintentionally create new, exploitable resources that attackers can use to…
CWE-1250 Hermano
Improper Preservation of Consistency Between Independent Representations of Shared State
This vulnerability occurs when a system with multiple independent components (like distributed services or separate hardware units) each…
CWE-1329 Hermano
Reliance on Component That is Not Updateable
This vulnerability occurs when a product depends on a component that cannot be updated or patched to fix security flaws or critical bugs.
CWE-221 Hermano
Information Loss or Omission
This weakness occurs when an application fails to log critical security events or records them inaccurately, which can misguide security…
CWE-372 Hermano
Incomplete Internal State Distinction
This vulnerability occurs when an application fails to accurately track its own operational state. The system incorrectly assumes it's in…
CWE-400 Hermano
Uncontrolled Resource Consumption
This vulnerability occurs when an application fails to properly manage a finite resource, allowing an attacker to exhaust it and cause a…
CWE-404 Hermano
Improper Resource Shutdown or Release
This vulnerability occurs when a program fails to properly close or release a system resource—like a file handle, database connection, or…
Listo cuando tú lo estés
Deja de pagar por desarrollador.
Empieza a cerrar el bucle.
Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.