BDady160877 (Community Member) asked a question.

August 5, 2020 at 10:11 PM
Inconsistent identification of CWE-15 flaws

I am having trouble resolving or even justifying a mitigation for a CWE-15 flaw that a static scan identified in one of our files for a line like:

 

mysql_select_db(MY_DATABASE_NAME);

 

Where MY_DATABASE_NAME comes from a different file that is loaded by this file.

 

Just a few lines before, however, we have the following:

 

mysql_connect(MY_DATABASE_HOST_ADDRESS, MY_DATABASE_USERNAME, MY_DATABASE_PASSWORD);

 

Where MY_DATABASE_HOST_ADDRESS, MY_DATABASE_USERNAME, and MY_DATABASE_PASSWORD all come from the same file as MY_DATABASE_NAME, but no flaw has been identified with this line.

 

If the problem is that we are getting a value from an external file, then why is the other line not being flagged? If that's not the problem, then what is the problem?

  • 4 answers
  • 791 views
NKlimchuk212120 likes this.

  • Boy, Security Consultant (Veracode)

    Veracode Static Analysis reports CWE 15 External Control of System or Configuration Setting when it can detect that a connection parameter (like connection details for the database) are consist (partly) of data from an application input such as data from an HTTP request but also data from the database, a file read or webservice.

     

    The concern being that an attacker may be able to use this input to influence the system into for example connecting to a remote database or an attacker can learn more information by attempting various connection settings and observing system timing.

     

    System configuration settings should originate from some trusted source and should be validated to ensure they conform to expected values (not relevant for your case where the API only expects a database name, but some APIs may also accept something like &username= and use it as a username).

     

    Veracode Static Analysis is unable to determine whether a given application input is trusted or not and is unable to evaluate whether validation (using something like a regex) has occurred and is sufficient. The only thing that it will automatically recognize is to hardcode all parts of the input.

    If however both controls are in place (trusted origin data and validation) and Veracode Static Analysis still reports the flaw on rescan I would recommend proposing a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contacting your security team to approve the mitigation proposal.

     

    Thank you,

    Boy Baukema

    Expand Post
    Selected as Best

  • Boy, Security Consultant (Veracode)

    Hi @BDady160877 (Community Member)​ ,

     

    I'm sorry to hear we're not reporting 'mysql_connect' for CWE 15.

    I would recommend you contact our technical support team. Here's how you can log a case:

    1. Navigate to the upper right corner of any page in the Community, click on your user avatar.

    2. Select Contact Support from the drop-down menu.

     

    In your case please mention:

    1. A URL to the Veracode Platform (https://analysiscenter.veracode.com/ or web.analysiscenter) where the results no older than 30 days can be found.
    2. The file and line where the mysql_connect can be found.

     

    Thank you,

    Boy Baukema

    Expand Post

      • Boy, Security Consultant (Veracode)

        Veracode Static Analysis reports CWE 15 External Control of System or Configuration Setting when it can detect that a connection parameter (like connection details for the database) are consist (partly) of data from an application input such as data from an HTTP request but also data from the database, a file read or webservice.

         

        The concern being that an attacker may be able to use this input to influence the system into for example connecting to a remote database or an attacker can learn more information by attempting various connection settings and observing system timing.

         

        System configuration settings should originate from some trusted source and should be validated to ensure they conform to expected values (not relevant for your case where the API only expects a database name, but some APIs may also accept something like &username= and use it as a username).

         

        Veracode Static Analysis is unable to determine whether a given application input is trusted or not and is unable to evaluate whether validation (using something like a regex) has occurred and is sufficient. The only thing that it will automatically recognize is to hardcode all parts of the input.

        If however both controls are in place (trusted origin data and validation) and Veracode Static Analysis still reports the flaw on rescan I would recommend proposing a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contacting your security team to approve the mitigation proposal.

         

        Thank you,

        Boy Baukema

        Expand Post
        Selected as Best

      • BDady160877 (Community Member)

        Thank you again -- this is very helpful!

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.