Détail du CWE-623

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Modes d'introduction

Architecture and Design
Implementation

Conséquences courantes

Exemples observés

Mesures d’atténuation potentielles

Phases : Architecture and Design
During development, do not mark it as safe for scripting.
Phases : System Configuration
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Références

REF-503

Developing Secure ActiveX Controls
Microsoft.
https://learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN

REF-510

How to stop an ActiveX control from running in Internet Explorer
Microsoft.
https://support.microsoft.com/en-us/help/240797/how-to-stop-an-activex-control-from-running-in-internet-explorer

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

Soumission

Modifications