Skip to content

Commit dc78bfc

Browse files
david-a-wheelerdavid-a-wheeler
committed
Copy 2019 CWE Top 25 down, link secret scanners
Signed-off-by: David A. Wheeler <[email protected]>
1 parent a7852b9 commit dc78bfc

File tree

1 file changed

+241
-1
lines changed

1 file changed

+241
-1
lines changed

‎secure_software_development_fundamentals.md

Lines changed: 241 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3496,7 +3496,9 @@ Here are some kinds of vulnerabilities that specialized SAST tools can detect:
34963496

34973497
* Regular Expression Denial-of-Service (ReDoS) vulnerabilities (that is, regular expressions with terrible worst-case performance). You can look for terms like “ReDoS”, “evil regex”, and “safe regex”. These extract the regular expressions from source code, and then analyze the regular expressions.
34983498

3499-
* Hardcoded credentials such as cryptographic keys and passwords.
3499+
* Hardcoded credentials such as cryptographic keys and passwords. Tools that look for hardcoded credentials are sometimes called “secret scanners”.
3500+
3501+
🔔 Hardcoded credentials are such a common problem that they are 2021 CWE Top 25 #16, [CWE-798](https://cwe.mitre.org/data/definitions/798.html), Use of Hard-coded Credentials. This is one reason why secret scanners have rapidly become popular.
35003502

35013503
#### Other Static Analysis Tools
35023504

@@ -5163,6 +5165,244 @@ Many others discuss how to develop secure software. This course merely covers th
51635165

51645166
* The BSA Framework for Secure Software [https://www.bsa.org/files/reports/bsa_software_security_framework_web_final.pdf](https://www.bsa.org/files/reports/bsa_software_security_framework_web_final.pdf)
51655167

5168+
* OWASP Secure Coding Practices-Quick Reference Guide <https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/migrated_content>
5169+
5170+
# Old Mappings
5171+
5172+
## OWASP Top 10 and CWE Top 25
5173+
5174+
### CWE Top 25
5175+
5176+
Here is the 2019 edition of the [CWE Top 25 Most Dangerous Software Errors](https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html). This list was created using real-world data, specifically, the publicly known vulnerabilities with Common Vulnerabilities and Exposures (CVE) as published in the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), including the severity scores as calculated using the Common Vulnerability Scoring System (CVSS) scores. This list combines many different kinds of software; whether or not that is good depends on your perspective.
5177+
5178+
No system is perfect. A complication is that the CWEs identified here are at various hierarchical levels. For example, #1 [CWE-119](https://cwe.mitre.org/data/definitions/119.html) (*Improper Restriction of Operations within the Bounds of a Memory Buffer*) is a superset of both #5 [CWE-125](https://cwe.mitre.org/data/definitions/125.html) (*Out-of-bounds read*) and #12 [CWE-787](https://cwe.mitre.org/data/definitions/787.html) (*Out-of-bounds Write*), yet they are all listed here. Still, this does provide a defensible and repeatable approach for identifying what’s important.
5179+
5180+
#### Top 25
5181+
5182+
<table>
5183+
<tr>
5184+
<td>Rank</td>
5185+
<td>ID</td>
5186+
<td>Name</td>
5187+
</tr>
5188+
<tr>
5189+
<td>[1]</td>
5190+
<td><a href="https://cwe.mitre.org/data/definitions/119.html">CWE-119</a></td>
5191+
<td>Improper Restriction of Operations within the Bounds of a Memory Buffer</td>
5192+
</tr>
5193+
<tr>
5194+
<td>[2]</td>
5195+
<td><a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79</a></td>
5196+
<td>Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)</td>
5197+
</tr>
5198+
<tr>
5199+
<td>[3]</td>
5200+
<td><a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20</a></td>
5201+
<td>Improper Input Validation</td>
5202+
</tr>
5203+
<tr>
5204+
<td>[4]</td>
5205+
<td><a href="https://cwe.mitre.org/data/definitions/200.html">CWE-200</a></td>
5206+
<td>Information Exposure</td>
5207+
</tr>
5208+
<tr>
5209+
<td>[5]</td>
5210+
<td><a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a></td>
5211+
<td>Out-of-bounds Read</td>
5212+
</tr>
5213+
<tr>
5214+
<td>[6]</td>
5215+
<td><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89</a></td>
5216+
<td>Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)</td>
5217+
</tr>
5218+
<tr>
5219+
<td>[7]</td>
5220+
<td><a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a></td>
5221+
<td>Use After Free</td>
5222+
</tr>
5223+
<tr>
5224+
<td>[8]</td>
5225+
<td><a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a></td>
5226+
<td>Integer Overflow or Wraparound</td>
5227+
</tr>
5228+
<tr>
5229+
<td>[9]</td>
5230+
<td><a href="https://cwe.mitre.org/data/definitions/352.html">CWE-352</a></td>
5231+
<td>Cross-Site Request Forgery (CSRF)</td>
5232+
</tr>
5233+
<tr>
5234+
<td>[10]</td>
5235+
<td><a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a></td>
5236+
<td>Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)</td>
5237+
</tr>
5238+
<tr>
5239+
<td>[11]</td>
5240+
<td><a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78</a></td>
5241+
<td>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)</td>
5242+
</tr>
5243+
<tr>
5244+
<td>[12]</td>
5245+
<td><a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a></td>
5246+
<td>Out-of-bounds Write</td>
5247+
</tr>
5248+
<tr>
5249+
<td>[13]</td>
5250+
<td><a href="https://cwe.mitre.org/data/definitions/287.html">CWE-287</a></td>
5251+
<td>Improper Authentication</td>
5252+
</tr>
5253+
<tr>
5254+
<td>[14]</td>
5255+
<td><a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476</a></td>
5256+
<td>NULL Pointer Dereference</td>
5257+
</tr>
5258+
<tr>
5259+
<td>[15]</td>
5260+
<td><a href="https://cwe.mitre.org/data/definitions/732.html">CWE-732</a></td>
5261+
<td>Incorrect Permission Assignment for Critical Resource</td>
5262+
</tr>
5263+
<tr>
5264+
<td>[16]</td>
5265+
<td><a href="https://cwe.mitre.org/data/definitions/434.html">CWE-434</a></td>
5266+
<td>Unrestricted Upload of File with Dangerous Type</td>
5267+
</tr>
5268+
<tr>
5269+
<td>[17]</td>
5270+
<td><a href="https://cwe.mitre.org/data/definitions/611.html">CWE-611</a></td>
5271+
<td>Improper Restriction of XML External Entity Reference</td>
5272+
</tr>
5273+
<tr>
5274+
<td>[18]</td>
5275+
<td><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94</a></td>
5276+
<td>Improper Control of Generation of Code (‘Code Injection’)</td>
5277+
</tr>
5278+
<tr>
5279+
<td>[19]</td>
5280+
<td><a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a></td>
5281+
<td>Use of Hard-coded Credentials</td>
5282+
</tr>
5283+
<tr>
5284+
<td>[20]</td>
5285+
<td><a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a></td>
5286+
<td>Uncontrolled Resource Consumption</td>
5287+
</tr>
5288+
<tr>
5289+
<td>[21]</td>
5290+
<td><a href="https://cwe.mitre.org/data/definitions/772.html">CWE-772</a></td>
5291+
<td>Missing Release of Resource after Effective Lifetime</td>
5292+
</tr>
5293+
<tr>
5294+
<td>[22]</td>
5295+
<td><a href="https://cwe.mitre.org/data/definitions/426.html">CWE-426</a></td>
5296+
<td>Untrusted Search Path</td>
5297+
</tr>
5298+
<tr>
5299+
<td>[23]</td>
5300+
<td><a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a></td>
5301+
<td>Deserialization of Untrusted Data</td>
5302+
</tr>
5303+
<tr>
5304+
<td>[24]</td>
5305+
<td><a href="https://cwe.mitre.org/data/definitions/269.html">CWE-269</a></td>
5306+
<td>Improper Privilege Management</td>
5307+
</tr>
5308+
<tr>
5309+
<td>[25]</td>
5310+
<td><a href="https://cwe.mitre.org/data/definitions/295.html">CWE-295</a></td>
5311+
<td>Improper Certificate Validation</td>
5312+
</tr>
5313+
</table>
5314+
5315+
5316+
#### On the Cusp
5317+
5318+
The developers of the CWE Top 25 felt that there were a number of weaknesses that were important, but did not manage to be in their top 25 because they were not as prevalent or tended to be less severe. They call these weaknesses *on the cusp*.
5319+
5320+
Developers that complete mitigation and risk decision-making on the 2019 CWE Top 25 may want to look for these other weaknesses potentially present in their software. For these reasons, users of the 2019 CWE Top 25 should seriously consider including these additional weaknesses in their analyses:
5321+
5322+
<table>
5323+
<tr>
5324+
<td>Rank</td>
5325+
<td>ID</td>
5326+
<td>Name</td>
5327+
</tr>
5328+
<tr>
5329+
<td>[26]</td>
5330+
<td><a href="https://cwe.mitre.org/data/definitions/835.html">CWE-835</a></td>
5331+
<td>Loop with Unreachable Exit Condition (‘Infinite Loop’)</td>
5332+
</tr>
5333+
<tr>
5334+
<td>[27]</td>
5335+
<td><a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522</a></td>
5336+
<td>Insufficiently Protected Credentials</td>
5337+
</tr>
5338+
<tr>
5339+
<td>[28]</td>
5340+
<td><a href="https://cwe.mitre.org/data/definitions/704.html">CWE-704</a></td>
5341+
<td>Incorrect Type Conversion or Cast</td>
5342+
</tr>
5343+
<tr>
5344+
<td>[29]</td>
5345+
<td><a href="https://cwe.mitre.org/data/definitions/362.html">CWE-362</a></td>
5346+
<td>Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)</td>
5347+
</tr>
5348+
<tr>
5349+
<td>[30]</td>
5350+
<td><a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918</a></td>
5351+
<td>Server-Side Request Forgery (SSRF)</td>
5352+
</tr>
5353+
<tr>
5354+
<td>[31]</td>
5355+
<td><a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415</a></td>
5356+
<td>Double Free</td>
5357+
</tr>
5358+
<tr>
5359+
<td>[32]</td>
5360+
<td><a href="https://cwe.mitre.org/data/definitions/601.html">CWE-601</a></td>
5361+
<td>URL Redirection to Untrusted Site (‘Open Redirect’)</td>
5362+
</tr>
5363+
<tr>
5364+
<td>[33]</td>
5365+
<td><a href="https://cwe.mitre.org/data/definitions/863.html">CWE-863</a></td>
5366+
<td>Incorrect Authorization</td>
5367+
</tr>
5368+
<tr>
5369+
<td>[34]</td>
5370+
<td><a href="https://cwe.mitre.org/data/definitions/862.html">CWE-862</a></td>
5371+
<td>Missing Authorization</td>
5372+
</tr>
5373+
<tr>
5374+
<td>[35]</td>
5375+
<td><a href="https://cwe.mitre.org/data/definitions/532.html">CWE-532</a></td>
5376+
<td>Inclusion of Sensitive Information in Log Files</td>
5377+
</tr>
5378+
<tr>
5379+
<td>[36]</td>
5380+
<td><a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306</a></td>
5381+
<td>Missing Authentication for Critical Function</td>
5382+
</tr>
5383+
<tr>
5384+
<td>[37]</td>
5385+
<td><a href="https://cwe.mitre.org/data/definitions/384.html">CWE-384</a></td>
5386+
<td>Session Fixation</td>
5387+
</tr>
5388+
<tr>
5389+
<td>[38]</td>
5390+
<td><a href="https://cwe.mitre.org/data/definitions/326.html">CWE-326</a></td>
5391+
<td>Inadequate Encryption Strength</td>
5392+
</tr>
5393+
<tr>
5394+
<td>[39]</td>
5395+
<td><a href="https://cwe.mitre.org/data/definitions/770.html">CWE-770</a></td>
5396+
<td>Allocation of Resources Without Limits or Throttling</td>
5397+
</tr>
5398+
<tr>
5399+
<td>[40]</td>
5400+
<td><a href="https://cwe.mitre.org/data/definitions/617.html">CWE-617</a></td>
5401+
<td>Reachable Assertion</td>
5402+
</tr>
5403+
</table>
5404+
5405+
51665406
# References
51675407

51685408
(Not part of the course per se)

0 commit comments

Comments
 (0)