Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.
CWE-669 Classe Brouillon
Incorrect Resource Transfer Between Spheres
This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper…
Définition
What is CWE-669?
This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper transfer can give unintended actors control over that resource, leading to security breaches.
Think of your application as having separate, secure zones—like a user interface (client-side), a backend server, and an administrative panel. Each zone has its own level of trust and permitted actions. This weakness happens when a resource, such as a user session, a file handle, or an administrative function, is mistakenly allowed to cross from a less-trusted zone into a more-trusted one, or is imported without proper validation. For example, a web application might incorrectly accept and process a user-supplied file path as if it originated from the secure server itself, allowing an attacker to access sensitive system files.
To prevent this, developers must enforce strict boundaries between different spheres of control. Always validate and sanitize any resource that moves between contexts, explicitly check the origin of requests, and implement the principle of least privilege so that resources can only be used within their intended security scope. Auditing data flows and trust transitions in your architecture is key to identifying and fixing these improper transfers.
Impact réel
Real-world CVEs caused by CWE-669
-
Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494).
-
PHP-based FAQ management app does not check the MIME type for uploaded images
-
Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error).
Comment les attaquants l'exploitent
Parcours de l'attaquant étape par étape
- 1
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
- 2
When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.
- 3
This code does not perform a check on the type of the file being uploaded (CWE-434). This could allow an attacker to upload any executable file or other file with malicious code.
- 4
Additionally, the creation of the BufferedWriter object is subject to relative path traversal (CWE-23). Since the code does not check the filename that is provided in the header, an attacker can use "../" sequences to write to files outside of the intended directory. Depending on the executing environment, the attacker may be able to specify arbitrary files to write to, leading to a wide variety of consequences, from code execution, XSS (CWE-79), or system crash.
- 5
This code includes an external script to get database credentials, then authenticates a user against the database, allowing access to the application.
Exemple de code vulnérable
Vulnerable Java
When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.
public class FileUploadServlet extends HttpServlet {
...
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.setContentType("text/html");
PrintWriter out = response.getWriter();
String contentType = request.getContentType();
// the starting position of the boundary header
int ind = contentType.indexOf("boundary=");
String boundary = contentType.substring(ind+9);
String pLine = new String();
String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value
// verify that content type is multipart form data
if (contentType != null && contentType.indexOf("multipart/form-data") != -1) {
// extract the filename from the Http header
BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
...
pLine = br.readLine();
String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));
...
// output the file to the local upload directory
try {
BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));
for (String line; (line=br.readLine())!=null; ) {
if (line.indexOf(boundary) == -1) {
bw.write(line);
bw.newLine();
bw.flush();
}
} //end of for loop
bw.close();
} catch (IOException ex) {...}
// output successful upload response HTML page
}
// output unsuccessful upload response HTML page
else
{...}
}
...
} Exemple de code sécurisé
Secure HTML
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
<form action="FileUploadServlet" method="post" enctype="multipart/form-data">
Choose a file to upload:
<input type="file" name="filename"/>
<br/>
<input type="submit" name="submit" value="Submit"/>
</form> What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Liste de contrôle de prévention
How to prevent CWE-669
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Signaux de détection
How to detect CWE-669
Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.
Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.
Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.
Plexicus détecte automatiquement CWE-669 et ouvre une PR de correction en moins de 60 secondes.
Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.
Questions fréquentes Qu'est-ce que CWE-669 ?
Quelle est la gravité de CWE-669 ?
Quels langages ou plateformes sont affectés par CWE-669 ?
Comment puis-je prévenir CWE-669 ?
Comment Plexicus détecte et corrige CWE-669 ?
Où puis-je en savoir plus sur CWE-669 ?
Frequently asked questions
Qu'est-ce que CWE-669 ?
This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper transfer can give unintended actors control over that resource, leading to security breaches.
Quelle est la gravité de CWE-669 ?
MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.
Quels langages ou plateformes sont affectés par CWE-669 ?
MITRE n'a pas spécifié les plateformes affectées pour ce CWE — il peut s'appliquer à la plupart des stacks applicatives.
Comment puis-je prévenir CWE-669 ?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
Comment Plexicus détecte et corrige CWE-669 ?
Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-669 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.
Où puis-je en savoir plus sur CWE-669 ?
MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/669.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.
Faiblesses associées
Weaknesses related to CWE-669
CWE-664 Parent
Improper Control of a Resource Through its Lifetime
This vulnerability occurs when software fails to properly manage a resource throughout its entire lifecycle—from creation and active use…
CWE-118 Frère
Incorrect Access of Indexable Resource ('Range Error')
This vulnerability occurs when software fails to properly check the boundaries of an indexed resource, like an array, buffer, or file,…
CWE-1229 Frère
Creation of Emergent Resource
This vulnerability occurs when a system's normal operations unintentionally create new, exploitable resources that attackers can use to…
CWE-1250 Frère
Improper Preservation of Consistency Between Independent Representations of Shared State
This vulnerability occurs when a system with multiple independent components (like distributed services or separate hardware units) each…
CWE-1329 Frère
Reliance on Component That is Not Updateable
This vulnerability occurs when a product depends on a component that cannot be updated or patched to fix security flaws or critical bugs.
CWE-221 Frère
Information Loss or Omission
This weakness occurs when an application fails to log critical security events or records them inaccurately, which can misguide security…
CWE-372 Frère
Incomplete Internal State Distinction
This vulnerability occurs when an application fails to accurately track its own operational state. The system incorrectly assumes it's in…
CWE-400 Frère
Uncontrolled Resource Consumption
This vulnerability occurs when an application fails to properly manage a finite resource, allowing an attacker to exhaust it and cause a…
CWE-404 Frère
Improper Resource Shutdown or Release
This vulnerability occurs when a program fails to properly close or release a system resource—like a file handle, database connection, or…
Prêt quand vous l'êtes
Arrêtez de payer par développeur.
Commencez à fermer la boucle.
Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.