deardaniel/secdata-raw huggingface dataset:
CWE-941: Incorrectly Specified Destination in a Communication Channel

Description:
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Extended Description:
Attackers at the destination may be able to spoof trusted servers to steal data or cause a denial of service. 
             There are at least two distinct weaknesses that can cause the product to communicate with an unintended destination: 
                
                   If the product allows an attacker to control which destination is specified, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and sends a reply, it will specify a destination by using the source of the incoming packet - i.e., the false source. The server can then be tricked into sending traffic to the wrong host, which is effective for hiding the real source of an attack and for conducting a distributed denial of service (DDoS). As another example, server-side request forgery (SSRF) and XML External Entity (XXE)

Affected languages: Not Language-Specific
Affected technologies: Mobile
Parent weaknesses: CWE-923

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Demonstrative examples:
This code listens on a port for DNS requests and sends the result to the requesting address.
This code sends a DNS record to a requesting IP address. UDP allows the source IP address to be easily changed ('spoofed'), thus allowing an attacker to redirect responses to a target, which may be then be overwhelmed by the network traffic.
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind( (UDP_IP,UDP_PORT) ) while true: 
                         data = sock.recvfrom(1024) if not data: break 
                            (requestIP, nameToResolve) = parseUDPpacket(data) record = resolveName(nameToResolve) sendResponse(requestIP,record)

Real-world examples:
  - CVE-2013-5211: composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses.
  - CVE-1999-0513: Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.
  - CVE-1999-1379: DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.
CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

Affected languages: PHP, Perl, Interpreted
Parent weaknesses: CWE-94

Consequences:
  - Confidentiality: Read Files or Directories
  - Access Control: Bypass Protection Mechanism
  - Access Control: Gain Privileges or Assume Identity
  - Integrity: Execute Unauthorized Code or Commands
  - Non-Repudiation: Hide Activities

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] Perform proper output validation and escaping to neutralize all code syntax from data written to code files.

Demonstrative examples:
This example attempts to write user messages to a message file and allow users to view them.
While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }
name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

Real-world examples:
  - CVE-2002-0495: Perl code directly injected into CGI library file from parameters to another CGI program.
  - CVE-2005-1876: Direct PHP code injection into supporting template file.
  - CVE-2005-1894: Direct code injection into PHP script that can be accessed by attacker.
  - CVE-2003-0395: PHP code from User-Agent HTTP header directly inserted into log file implemented as PHP script.
  - CVE-2007-6652: chain: execution after redirect allows non-administrator to perform static code injection.
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Description:
The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-96

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands
MITRE CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

Description:
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

Mitigations:
  - In a J2EE setting, administrators can associate a role that is impossible for the authenticator to grant users, such as "NoAccess", with all Servlets to which access is guarded by a limited number of 

Related CWEs: 276, 285, 434, 693, 732, 1191, 1193, 1220, 1297, 1311
MITRE CAPEC-10: Buffer Overflow via Environment Variables

Description:
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.

Mitigations:
  - Do not expose environment variable to the user.
  - Do not use untrusted data in your environment variables.
  - Use a language or compiler that performs automatic bounds checking

Related CWEs: 120, 302, 118, 119, 74, 99, 20, 680, 733, 697
MITRE CAPEC-100: Overflow Buffers

Description:
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.

Mitigations:
  - Use a language or compiler that performs automatic bounds checking.
  - Use secure functions not vulnerable to buffer overflow.
  - If you have to use dangerous functions, make sure that you do boundary checking.

Related CWEs: 120, 119, 131, 129, 805, 680
MITRE CAPEC-101: Server Side Include (SSI) Injection

Description:
An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.

Mitigations:
  - Set the OPTIONS IncludesNOEXEC in the global access.conf file or local .htaccess (Apache) file to deny SSI execution in directories that do not need them
  - All user controllable input must be appropriately sanitized before use in the application. This includes omitting, or encoding, certain characters or strings that have the potential of being interpret
  - Server Side Includes must be enabled only if there is a strong business reason to do so. Every additional component enabled on the web server increases the attack surface as well as administrative ove

Related CWEs: 97, 74, 20
MITRE CAPEC-102: Session Sidejacking

Description:
Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.

Mitigations:
  - Make sure that HTTPS is used to communicate with the target system. Alternatively, use VPN if possible. It is important to ensure that all communication between the client and the server happens via a
  - Modify the session token with each transmission and protect it with cryptography. Add the idea of request sequencing that gives the server an ability to detect replay attacks.

Related CWEs: 294, 522, 523, 319, 614
MITRE CAPEC-103: Clickjacking

Description:
An adversary tricks a victim into unknowingly initiating some action in one system while interacting with the UI from a seemingly completely different, usually an adversary controlled or intended, system.

Mitigations:
  - If using the Firefox browser, use the NoScript plug-in that will help forbid iFrames.
  - Turn off JavaScript, Flash and disable CSS.
  - When maintaining an authenticated session with a privileged target system, do not use the same browser to navigate to unfamiliar sites to perform other activities. Finish working with the target syste

Related CWEs: 1021
MITRE CAPEC-104: Cross Zone Scripting

Description:
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.

Mitigations:
  - Disable script execution.
  - Ensure that sufficient input validation is performed for any potentially untrusted data before it is used in any privileged context or zone
  - Limit the flow of untrusted data into the privileged areas of the system that run in the higher trust zone

Related CWEs: 250, 638, 285, 116, 20
MITRE CAPEC-105: HTTP Request Splitting

Description:
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to split a single HTTP request into multiple unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). 
             See CanPrecede relationships for possible consequences.

Mitigations:
  - Design: evaluate HTTP agents prior to deployment for parsing/interpretation discrepancies.
  - Configuration: front-end HTTP agents notice ambiguous requests.
  - Configuration: back-end HTTP agents reject ambiguous requests and close the network connection.

Related CWEs: 74, 113, 138, 436
MITRE CAPEC-107: Cross Site Tracing

Description:
Cross Site Tracing (XST) enables an adversary to steal the victim's session cookie and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to a destination system's web server.

Mitigations:
  - Administrators should disable support for HTTP TRACE at the destination's web server. Vendors should disable TRACE by default.
  - Patch web browser against known security origin policy bypass exploits.

Related CWEs: 693, 648
MITRE CAPEC-108: Command Line Execution through SQL Injection

Description:
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Mitigations:
  - Disable MSSQL xp_cmdshell directive on the database
  - Properly validate the data (syntactically and semantically) before writing it to the database.
  - Do not implicitly trust the data stored in the database. Re-validate it prior to usage to make sure that it is safe to use in a given context (e.g. as a command line argument).

Related CWEs: 89, 74, 20, 78, 114
MITRE CAPEC-109: Object Relational Mapping Injection

Description:
An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject their own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.

Mitigations:
  - Remember to understand how to use the data access methods generated by the ORM tool / framework properly in a way that would leverage the built-in security mechanisms of the framework
  - Ensure to keep up to date with security relevant updates to the persistence framework used within your application.

Related CWEs: 20, 89, 564
MITRE CAPEC-11: Cause Web Server Misclassification

Description:
An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process.

Mitigations:
  - Implementation: Server routines should be determined by content not determined by filename or file extension.

Related CWEs: 430
MITRE CAPEC-110: SQL Injection through SOAP Parameter Tampering

Description:
An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.

Mitigations:
  - Properly validate and sanitize/reject user input at the service provider.
  - Ensure that prepared statements or other mechanism that enables parameter binding is used when accessing the database in a way that would prevent the attackers' supplied data from controlling the stru
  - At the database level, ensure that the database user used by the application in a particular context has the minimum needed privileges to the database that are needed to perform the operation. When po

Related CWEs: 89, 20
MITRE CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)

Description:
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.

Mitigations:
  - Ensure that server side code can differentiate between legitimate requests and forged requests. The solution is similar to protection against Cross Site Request Forger (CSRF), which is to use a hard t
  - On the client side, the system's design could make it difficult to get access to the JSON object content via the script tag. Since the JSON object is never assigned locally to a variable, it cannot be
  - Make the URLs in the system used to retrieve JSON objects unpredictable and unique for each user session.

Related CWEs: 345, 346, 352
MITRE CAPEC-112: Brute Force

Description:
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.

Mitigations:
  - Select a provably large secret space for selection of the secret. Provably large means that the procedure by which the secret is selected does not have artifacts that significantly reduce the size of 
  - Use a secret space that is well known and with no known patterns that may reduce functional size.
  - Do not provide the means for an attacker to determine success independently. This forces the attacker to check their guesses against an external authority, which can slow the attack and warn the defen

Related CWEs: 330, 326, 521
MITRE CAPEC-113: Interface Manipulation

Description:
An adversary manipulates the use or processing of an interface (e.g. Application Programming Interface (API) or System-on-Chip (SoC)) resulting in an adverse impact upon the security of the system implementing the interface. This can allow the adversary to bypass access control and/or execute functionality not intended by the interface implementation, possibly compromising the system which integrates the interface. Interface manipulation can take on a number of forms including forcing the unexpected use of an interface or the use of an interface in an unintended way.

Related CWEs: 1192
MITRE CAPEC-114: Authentication Abuse

Description:
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.

Related CWEs: 287, 1244
MITRE CAPEC-115: Authentication Bypass

Description:
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.

Related CWEs: 287
MITRE CAPEC-116: Excavation

Description:
An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.

Mitigations:
  - Minimize error/response output to only what is necessary for functional use or corrective language.
  - Remove potentially sensitive information that is not necessary for the application's functionality.

Related CWEs: 200, 1243
MITRE CAPEC-117: Interception

Description:
An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream or passively observe the communications as they unfold. In all variants of this attack, the adversary is not the intended recipient of the data stream. In contrast to other means of gathering information (e.g., targeting data leaks), the adversary must actively position themself so as to observe explicit data channels (e.g. network traffic) and read the content. However, this attack differs from a Adversary-In-the-Middle (CAPEC-94) attack, as the adversary does not alter the content of the communications nor forward data to the intended recipient.

Mitigations:
  - Leverage encryption to encode the transmission of data thus making it accessible only to authorized parties.

Related CWEs: 319
MITRE CAPEC-12: Choosing Message Identifier

Description:
This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.

Mitigations:
  - Associate some ACL (in the form of a token) with an authenticated user which they provide middleware. The middleware uses this token as part of its channel/message selection for that client, or part o
  - Re-architect system input/output channels as appropriate to distribute self-protecting data. That is, encrypt (or otherwise protect) channels/messages so that only authorized readers can see them.

Related CWEs: 201, 306