CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Description:
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-669, CWE-669

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Detection methods:
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Mitigations:
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
  - [Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. 
                   For example, ID 1 could map to "inbox.txt" and ID 2 could map 
  - [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-s
  - [Architecture and Design] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. 
                   OS-level ex

Demonstrative examples:
This login webpage includes a weather widget from an external website:
This webpage is now only as secure as the external domain it is including functionality from. If an attacker compromised the external domain and could add malicious scripts to the weatherwidget.js file, the attacker would have complete control, as seen in any XSS weakness (CWE-79).
<div class="header"> Welcome! <div id="loginBox">Please Login: <form id ="loginForm" name="loginForm" action="login.php" method="post"> Username: <input type="text" name="username" /> <br/> Password: <input type="password" name="password" /> <input type="submit" value="Login" /> </form> </div> <div id="WeatherWidget"> <script type="text/javascript" src="externalDomain.example.com/weatherwidget.js"></script> </div> </div>
...Weather widget cod

Real-world examples:
  - CVE-2010-2076: Product does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service.
  - CVE-2004-0285: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2004-0030: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2004-0068: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.
  - CVE-2005-2157: Modification of assumed-immutable configuration variable in include file allows file inclusion via direct request.