Krutikp/ComplianceLLM huggingface dataset:
CWE-243: Creation of chroot Jail Without Changing Working Directory (Variant)

Description: The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.

Extended Description: Improper use of chroot() may allow attackers to escape from the chroot jail. The chroot() function call does not change the process's current working directory, so relative paths may still refer to file system resources outside of the chroot jail after chroot() has been called.

Background Details: ::The chroot() system call allows a process to change its perception of the root directory of the file system. After properly invoking chroot(), a process cannot access any files outside the directory tree defined by the new root directory. Such an environment is called a chroot jail and is commonly used to prevent the possibility that a processes could be subverted and used to access unauthorized files. For instance, many FTP servers run in chroot jails to prevent an attacker who discovers a new vulnerability in the server from being able to download the password file or other sensitive files on the system.::


Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Unix:OPERATING SYSTEM PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Files or Directories::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::




Affected Resources: ::File or Directory::
CWE-248: Uncaught Exception (Base)

Description: An exception is thrown from a function, but it is not caught.

Extended Description: When an exception is not caught, it may cause the program to crash or expose sensitive information.



Applicable Platforms: ::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:SCOPE:Confidentiality:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:Read Application Data:NOTE:An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information or other unintended behaviors.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::


Observed Examples: ::REFERENCE:CVE-2023-41151:DESCRIPTION:SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error:LINK:https://www.cve.org/CVERecord?id=CVE-2023-41151::REFERENCE:CVE-2023-21087:DESCRIPTION:Java code in a smartphone OS can encounter a boot loop due to an uncaught exception:LINK:https://www.cve.org/CVERecord?id=CVE-2023-21087::
CWE-253: Incorrect Check of Function Return Value (Base)

Description: The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Extended Description: Important and common functions will return some value about the success of its actions. This will alert the program whether or not to handle any errors caused by that function.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:SCOPE:Integrity:IMPACT:Unexpected State:IMPACT:DoS: Crash, Exit, or Restart:NOTE:An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.::


Potential Mitigations: ::PHASE:Architecture and Design:STRATEGY:Language Selection:DESCRIPTION:Use a language or compiler that uses exceptions and requires the catching of those exceptions.::PHASE:Implementation:DESCRIPTION:Properly check all functions which return a value.::PHASE:Implementation:DESCRIPTION:When designing any function make sure you return a value or throw an exception in case of an error.::

Observed Examples: ::REFERENCE:CVE-2023-49286:DESCRIPTION:Chain: function in web caching proxy does not correctly check a return value (CWE-253) leading to a reachable assertion (CWE-617):LINK:https://www.cve.org/CVERecord?id=CVE-2023-49286::
CWE-256: Plaintext Storage of a Password (Base)

Description: Storing a password in plaintext may result in a system compromise.

Extended Description: Password management issues occur when a password is stored in plaintext in an application's properties, configuration file, or memory. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Architecture and Design:NOTE:Developers sometimes believe that they cannot defend the application from someone who has access to the configuration, but this belief makes an attacker's job easier.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Avoid storing passwords in easily accessible locations.::PHASE:Architecture and Design:DESCRIPTION:Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.::PHASE::DESCRIPTION:A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.:EFFECTIVENESS:None::

Observed Examples: ::REFERENCE:CVE-2022-30275:DESCRIPTION:Remote Terminal Unit (RTU) uses a driver that relies on a password stored in plaintext.:LINK:https://www.cve.org/CVERecord?id=CVE-2022-30275::
CWE-257: Storing Passwords in a Recoverable Format (Base)

Description: The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:User's passwords may be revealed.::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:Revealed passwords may be reused elsewhere to impersonate the users in question.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use strong, non-reversible encryption to protect stored passwords.::

Observed Examples: ::REFERENCE:CVE-2022-30018:DESCRIPTION:A messaging platform serializes all elements of User/Group objects, making private information available to adversaries:LINK:https://www.cve.org/CVERecord?id=CVE-2022-30018::



Notes: ::TYPE:Maintenance:NOTE:The meaning of this entry needs to be investigated more closely, especially with respect to what is meant by recoverable.::
CWE-260: Password in Configuration File (Base)

Description: The product stores a password in a configuration file that might be accessible to actors who do not know the password.

Extended Description: This can result in compromise of the system for which the password is used. An attacker could gain access to this file and learn the stored password or worse yet, change the password to one of their choosing.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Avoid storing passwords in easily accessible locations.::PHASE:Architecture and Design:DESCRIPTION:Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.::

Observed Examples: ::REFERENCE:CVE-2022-38665:DESCRIPTION:A continuous delivery pipeline management tool stores an unencypted password in a configuration file.:LINK:https://www.cve.org/CVERecord?id=CVE-2022-38665::


Affected Resources: ::File or Directory::
CWE-261: Weak Encoding for Password (Base)

Description: Obscuring a password with a trivial encoding does not protect the password.

Extended Description: Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE::DESCRIPTION:Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.::




Notes: ::TYPE:Other:NOTE:The crypt family of functions uses weak cryptographic algorithms and should be avoided. It may be present in some projects for compatibility.::
CWE-262: Not Using Password Aging (Base)

Description: The product does not have a mechanism in place for managing password aging.

Extended Description: Password aging (or password rotation) is a policy that forces users to change their passwords after a defined time period passes, such as every 30 or 90 days. Without mechanisms such as aging, users might not change their passwords in a timely manner. Note that while password aging was once considered an important security feature, it has since fallen out of favor by many, because it is not as effective against modern threats compared to other mechanisms such as slow hashes. In addition, forcing frequent changes can unintentionally encourage users to select less-secure passwords. However, password aging is still in use due to factors such as compliance requirements, e.g., Payment Card Industry Data Security Standard (PCI DSS).



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:As passwords age, the probability that they are compromised grows.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:As part of a product's design, require users to change their passwords regularly and avoid reusing previous passwords.::PHASE:Implementation:DESCRIPTION:Developers might disable clipboard paste operations into password fields as a way to discourage users from pasting a password into a clipboard. However, this might encourage users to choose less-secure passwords that are easier to type, and it can reduce the usability of password managers [REF-1294].:EFFECTIVENESS:Discouraged Common Practice::
CWE-263: Password Aging with Long Expiration (Base)

Description: The product supports password aging, but the expiration period is too long.

Extended Description: Password aging (or password rotation) is a policy that forces users to change their passwords after a defined time period passes, such as every 30 or 90 days. A long expiration provides more time for attackers to conduct password cracking before users are forced to change to a new password. Note that while password aging was once considered an important security feature, it has since fallen out of favor by many, because it is not as effective against modern threats compared to other mechanisms such as slow hashes. In addition, forcing frequent changes can unintentionally encourage users to select less-secure passwords. However, password aging is still in use due to factors such as compliance requirements, e.g., Payment Card Industry Data Security Standard (PCI DSS).



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:As passwords age, the probability that they are compromised grows.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Ensure that password aging is limited so that there is a defined maximum age for passwords. Note that if the expiration window is too short, it can cause users to generate poor or predictable passwords.::PHASE:Architecture and Design:DESCRIPTION:Ensure that the user is notified several times leading up to the password expiration.::PHASE:Architecture and Design:DESCRIPTION:Create mechanisms to prevent users from reusing passwords or creating similar passwords.::PHASE:Implementation:DESCRIPTION:Developers might disable clipboard paste operations into password fields as a way to discourage users from pasting a password into a clipboard. However, this might encourage users to choose less-secure passwords that are easier to type, and it can reduce the usability of password managers [REF-1294].:EFFECTIVENESS:Discouraged Common Practice::
CWE-266: Incorrect Privilege Assignment (Base)

Description: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.::


Potential Mitigations: ::PHASE:Architecture and Design Operation:DESCRIPTION:Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.::PHASE:Architecture and Design Operation:STRATEGY:Environment Hardening:DESCRIPTION:Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.::

Observed Examples: ::REFERENCE:CVE-1999-1193:DESCRIPTION:untrusted user placed in unix wheel group:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1193::REFERENCE:CVE-2005-2741:DESCRIPTION:Product allows users to grant themselves certain rights that can be used to escalate privileges.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2741::REFERENCE:CVE-2005-2496:DESCRIPTION:Product uses group ID of a user instead of the group, causing it to run with different privileges. This is resultant from some other unknown issue.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2496::REFERENCE:CVE-2004-0274:DESCRIPTION:Product mistakenly assigns a particular status to an entity, leading to increased privileges.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0274::


Affected Resources: ::System Process::
CWE-268: Privilege Chaining (Base)

Description: Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::PHASE:Operation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:A user can be given or gain access rights of another user. This can give the user unauthorized access to sensitive information including the access information of another user.::


Potential Mitigations: ::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.::PHASE:Architecture and Design Operation:DESCRIPTION:Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.::PHASE:Architecture and Design Operation:STRATEGY:Environment Hardening:DESCRIPTION:Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.::

Observed Examples: ::REFERENCE:CVE-2005-1736:DESCRIPTION:Chaining of user rights.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1736::REFERENCE:CVE-2002-1772:DESCRIPTION:Gain certain rights via privilege chaining in alternate channel.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1772::REFERENCE:CVE-2005-1973:DESCRIPTION:Application is allowed to assign extra permissions to itself.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1973::REFERENCE:CVE-2003-0640:DESCRIPTION:operator user can overwrite usernames and passwords to gain admin privileges.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0640::



Notes: ::TYPE:Relationship:NOTE:There is some conceptual overlap with Unsafe Privilege.::