CWE-489: Active Debug Code
Description
The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Extended Description
A common development practice is to add "back door" code specifically designed for debugging or testing purposes that is not intended to be shipped or deployed with the product. These back door entry points create security risks because they are not considered during design or testing and fall outside of the expected operating conditions of the product.
Example - 1
Debug code can be used to bypass authentication. For example, suppose an application has a login script that receives a username and a password. Assume also that a third, optional, parameter, called "debug", is interpreted by the script as requesting a switch to debug mode, and that when this parameter is given the username and password are not checked. In such a case, it is very simple to bypass the authentication process if the special behavior of the application regarding the debug parameter is known. In a case where the form is:
<INPUT TYPE=TEXT name=username><INPUT TYPE=PASSWORD name=password><INPUT TYPE=SUBMIT><FORM ACTION="/authenticate_login.cgi"></FORM>Then a conforming link will look like:
http://TARGET/authenticate_login.cgi?username=...&password=...An attacker can change this to:
http://TARGET/authenticate_login.cgi?username=&password=&debug=1Which will grant the attacker access to the site, bypassing the authentication process.
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.