Nama: Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')

The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.

Informasi Umum

Mode Pengenalan

Architecture and Design
Implementation
Operation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Other	Other

Contoh yang Diamati

Referensi	Deskripsi
CVE-2007-6067	Support for complex regular expressions leads to a resultant algorithmic complexity weakness (CWE-407).
CVE-2007-1552	Either a filename extension and a Content-Type header could be used to infer the file type, but the developer only checks the Content-Type, enabling unrestricted file upload (CWE-434).
CVE-2007-6479	In Apache environments, a "filename.php.gif" can be redirected to the PHP interpreter instead of being sent as an image/gif directly to the user. Not knowing this, the developer only checks the last extension of a submitted filename, enabling arbitrary code execution.
CVE-2005-2148	The developer cleanses the $_REQUEST superglobal array, but PHP also populates $_GET, allowing attackers to bypass the protection mechanism and conduct SQL injection attacks against code that uses $_GET.

Mitigasi yang Memungkinkan

Phases : Architecture and Design
Security mechanisms should be as simple as possible. Complex security mechanisms may engender partial implementations and compatibility problems, with resulting mismatches in assumptions and implemented security. Avoid complex security mechanisms when simpler ones would meet requirements. Avoid complex data models, and unnecessarily complex operations. Adopt architectures that provide guarantees, simplify understanding through elegance and abstraction, and that can be implemented similarly. Modularize, isolate and do not trust complex code, and apply other secure programming principles on these modules (e.g., least privilege) to mitigate vulnerabilities.
Phases : Requirements
Data specifications should be as simple as possible, because complex data specifications result in complex validation code. Complex tasks and systems may also need to be guarded by complex security checks, so simple systems should be preferred.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is a Class, but it does not have Base-level children.
Komentar : This entry is classified in a part of CWE's hierarchy that does not have sufficiently low-level coverage, which might reflect a lack of classification-oriented weakness research in the software security community. Conduct careful root cause analysis to determine the original mistake that led to this weakness. If closer analysis reveals that this weakness is appropriate, then this might be the best available CWE to use for mapping. If no other option is available, then it is acceptable to map to this CWE.

Referensi

REF-196

The Protection of Information in Computer Systems
Jerome H. Saltzer, Michael D. Schroeder.
http://web.mit.edu/Saltzer/www/publications/protection/

REF-524

Economy of Mechanism
Sean Barnum, Michael Gegick.
https://web.archive.org/web/20220126060058/https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/economy-of-mechanism

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
Pascal Meunier	Purdue University	2008-01-18 +00:00	2008-01-30 +00:00	Draft 8

Modifikasi

Nama	Organisasi	Tanggal	Komentar
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Description, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2009-01-12 +00:00	updated Description, Name
CWE Content Team	MITRE	2010-12-13 +00:00	updated Name, Research_Gaps
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Causal_Nature
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated References
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2025-04-03 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2026-10-28 +00:00	updated Description, Potential_Mitigations

Detail CWE-637

CWE-637