繁體中文

CWE-489 詳細資料

CWE-489

Active Debug Code
2006-07-19
00h00 +00:00
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Active Debug Code

The product is released with debugging code still enabled or active.

一般資訊

引入方式

Implementation : In web-based applications, debug code is used to test and modify web application properties, configuration information, and functions. If a debug application is left on a production server, this oversight during the "software process" allows attackers access to debug functionality.
Implementation : A common development practice is to add "back door" code specifically designed for debugging or testing purposes that is not intended to be shipped or deployed with the product. These back door entry points create security risks because they are not considered during design or testing and fall outside of the expected operating conditions of the product.
Build and Compilation
Operation

適用平台

程式語言

類別： Not Language-Specific (Undetermined)
名稱： Python (Undetermined)

技術

類別： Not Technology-Specific (Undetermined)
類別： ICS/OT (Undetermined)

常見後果

範圍 影響 可能性
Confidentiality
Integrity
Availability
Access Control
Other		Bypass Protection Mechanism, Read Application Data, Gain Privileges or Assume Identity, Varies by Context

注意：Active debug code can create unintended entry points or expose sensitive information. The severity of the exposed debug code will depend on the particular instance. At the least, it will give an attacker sensitive information about the settings and mechanics of web applications on the server. At worst, as is often the case, the debug code will allow an attacker complete control over the web application and server, as well as confidential information that is accessed by either of these.

觀察到的案例

參考資料 描述

CVE-2024-44092

smartphone is built for production with debugging code present, allowing local privilege escalation

CVE-2024-36475

network hub contains active debug code, which allows users to execute arbitrary OS commands using a debug function

CVE-2024-29075

Mesh Wi-Fi router has active debug code, allowing attackers to modify device settings

潛在緩解措施

Phases : Build and Compilation // Distribution
Remove debug code before deploying the application.

偵測方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性 : High

漏洞對應備注

理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

相關攻擊模式

CAPEC ID 攻擊模式名稱
CAPEC-121 Exploit Non-Production Interfaces
CAPEC-661 Root/Jailbreak Detection Evasion via Debugging
An adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Rooting/Jailbreaking a mobile device also provides users with access to system debuggers and disassemblers, which can be leveraged to exploit applications by dumping the application's memory at runtime in order to remove or bypass signature verification methods. This further allows the adversary to evade Root/Jailbreak detection mechanisms, which can result in execution of administrative commands, obtaining confidential data, impersonating legitimate users of the application, and more.

備注

In J2EE a main method may be a good indicator that debug code has been left in the application, although there may not be any direct security impact.

參考資料

REF-6

Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Katrina Tsipenyuk, Brian Chess, Gary McGraw.
https://cwe.mitre.org/documents/sources/SevenPerniciousKingdoms.pdf

REF-1541

Secure Coding Guide for Python
OpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/

提交

名稱 機構 日期 發布日期 Version
7 Pernicious Kingdoms 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

修改記錄

名稱 機構 日期 備註
Eric Dalci Cigital 2008-07-01 +00:00 updated Potential_Mitigations, Time_of_Introduction
KDM Analytics 2008-08-01 +00:00 added/updated white box definitions
CWE Content Team MITRE 2008-09-08 +00:00 updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team MITRE 2009-07-27 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2009-10-29 +00:00 updated Common_Consequences
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2011-06-27 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2014-06-23 +00:00 updated Description, Modes_of_Introduction, Other_Notes, Time_of_Introduction
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2017-11-08 +00:00 updated Applicable_Platforms, Relationships, White_Box_Definitions
CWE Content Team MITRE 2019-01-03 +00:00 updated Weakness_Ordinalities
CWE Content Team MITRE 2019-06-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2020-02-24 +00:00 updated Description, Name, References, Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2021-07-20 +00:00 updated Alternate_Terms
CWE Content Team MITRE 2023-01-31 +00:00 updated Applicable_Platforms, Description, Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Detection_Factors, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-09-09 +00:00 updated Common_Consequences, Description, Diagram, Modes_of_Introduction
CWE Content Team MITRE 2025-12-11 +00:00 updated Relationships
CWE Content Team MITRE 2026-04-30 +00:00 updated Observed_Examples
CWE Content Team MITRE 2026-10-28 +00:00 updated Applicable_Platforms, Common_Consequences, References, Relationships, Taxonomy_Mappings
cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。