What is Use of Multiple Resources with Duplicate (CWE-694)?

TL;DR: Use of Multiple Resources with Duplicate Identifier (CWE-694) is a vulnerability that occurs when multiple resources have the same identifier, allowing attackers to bypass protection mechanisms. It can be fixed by ensuring unique identifiers are used.

What is Use of Multiple Resources with Duplicate Identifier?

Use of Multiple Resources with Duplicate Identifier (CWE-694) is a type of vulnerability that occurs when multiple resources can have the same identifier, leading to potential security issues. As defined by the MITRE Corporation under CWE-694, and not classified by the OWASP Foundation.

Quick Summary

This vulnerability arises from using non-unique identifiers for resources, which can allow attackers to bypass protection mechanisms designed to safeguard sensitive data. Understanding how this issue impacts your system is crucial for maintaining security integrity.

Jump to: Quick Summary · Use of Multiple Resources with Duplicate Identifier Overview · How Use of Multiple Resources with Duplicate Identifier Works · Business Impact of Use of Multiple Resources with Duplicate Identifier · Use of Multiple Resources with Duplicate Identifier Attack Scenario · How to Detect Use of Multiple Resources with Duplicate Identifier · How to Fix Use of Multiple Resources with Duplicate Identifier · Framework-Specific Fixes for Use of Multiple Resources with Duplicate Identifier · How to Ask AI to Check Your Code for Use of Multiple Resources with Duplicate Identifier · Use of Multiple Resources with Duplicate Identifier Best Practices Checklist · Use of Multiple Resources with Duplicate Identifier FAQ · Vulnerabilities Related to Use of Multiple Resources with Duplicate Identifier · References · Scan Your Own Site

Use of Multiple Resources with Duplicate Identifier Overview

What

Use of Multiple Resources with Duplicate Identifier is a vulnerability that occurs when resources can have the same identifier, leading to potential security issues.

Why it matters

This issue compromises system integrity and confidentiality by allowing attackers to bypass protection mechanisms designed to safeguard sensitive data.

Where it occurs

It commonly affects systems where resource identifiers are not properly managed or enforced as unique.

Who is affected

Developers and administrators who manage resources with duplicate identifiers in their applications are at risk.

Who is NOT affected

Systems that ensure unique identifiers for all resources are not vulnerable to this issue.

How Use of Multiple Resources with Duplicate Identifier Works

Root Cause

The root cause lies in the lack of enforcement or validation of unique resource identifiers, allowing multiple resources to share the same identifier.

Attack Flow

1. An attacker identifies a system using non-unique identifiers.
2. The attacker manipulates these identifiers to gain unauthorized access or manipulate data.

Prerequisites to Exploit

The system must allow multiple resources with duplicate identifiers and lack proper validation mechanisms.

Vulnerable Code

def manage_resources(identifier):
    # No check for unique identifier
    resource = get_resource_by_identifier(identifier)
    perform_operation(resource)

This code does not validate the uniqueness of identifier, allowing potential exploitation.

Secure Code

def manage_resources(identifier):
    if not is_unique_identifier(identifier):
        raise ValueError("Identifier must be unique")
    resource = get_resource_by_identifier(identifier)
    perform_operation(resource)

The secure version ensures that each identifier is unique before performing any operations on the resource.

Business Impact of Use of Multiple Resources with Duplicate Identifier

Confidentiality

• Sensitive data can be exposed to unauthorized access.
• Example: An attacker might bypass protection mechanisms and read sensitive information.

Integrity

• Data integrity can be compromised as attackers may modify resources that share the same identifier, leading to unexpected behavior or data corruption.

Availability

• System availability is not directly impacted by this vulnerability but could indirectly suffer due to unauthorized actions.

Use of Multiple Resources with Duplicate Identifier Attack Scenario

1. The attacker identifies a system using non-unique identifiers.
2. The attacker manipulates these identifiers to gain unauthorized access.
3. The attacker exploits the lack of validation for unique identifiers, leading to data manipulation or exposure.

How to Detect Use of Multiple Resources with Duplicate Identifier

Manual Testing

• Check if resource identifiers are enforced as unique.
• Review code for any operations that do not validate identifier uniqueness.
• Ensure error handling is in place when non-unique identifiers are detected.

Automated Scanners (SAST / DAST)

Static analysis can detect instances where resource identifiers are not validated, while dynamic testing can confirm the presence of vulnerabilities during runtime.

PenScan Detection

PenScan’s scanner engines such as ZAP and Wapiti can identify potential CWE-694 issues by analyzing code for non-unique identifier usage.

False Positive Guidance

A false positive occurs if a unique identifier is mistakenly flagged due to an incomplete analysis. Ensure that the context of resource management confirms the absence of validation logic.

How to Fix Use of Multiple Resources with Duplicate Identifier

• Ensure unique identifiers are used for all resources.
• Validate identifiers before performing any operations on them.
• Implement proper error handling when non-unique identifiers are detected.
• Report errors appropriately if non-unique identifiers are encountered.

Framework-Specific Fixes for Use of Multiple Resources with Duplicate Identifier

Python/Django

def manage_resources(identifier):
    if not is_unique_identifier(identifier):
        raise ValueError("Identifier must be unique")
    resource = get_resource_by_identifier(identifier)
    perform_operation(resource)

Java

public void manageResources(String identifier) {
    if (!isUniqueIdentifier(identifier)) {
        throw new IllegalArgumentException("Identifier must be unique");
    }
    Resource resource = getResourceByIdentifier(identifier);
    performOperation(resource);
}

How to Ask AI to Check Your Code for Use of Multiple Resources with Duplicate Identifier

Use of Multiple Resources with Duplicate Identifier Best Practices Checklist

✅ Ensure each resource has a unique identifier. ✅ Implement validation logic to check for non-unique identifiers before performing operations. ✅ Report errors appropriately when non-unique identifiers are detected.

Use of Multiple Resources with Duplicate Identifier FAQ

How can I identify if my system is vulnerable to Use of Multiple Resources with Duplicate Identifier?

Look for instances where resources are managed without ensuring unique identifiers, especially in configurations or databases.

What are the common consequences of a Use of Multiple Resources with Duplicate Identifier vulnerability?

Attackers might bypass protection mechanisms and cause quality degradation by exploiting duplicate resource identifiers.

How can I prevent Use of Multiple Resources with Duplicate Identifier in my application?

Ensure that unique identifiers are used for all resources, and report errors appropriately if non-unique identifiers are detected.

What is the impact on confidentiality when a Use of Multiple Resources with Duplicate Identifier occurs?

Sensitive data can be exposed to unauthorized access due to duplicate resource identifiers bypassing protection mechanisms.

How does Use of Multiple Resources with Duplicate Identifier affect system integrity?

Integrity can be compromised as attackers may modify resources that share the same identifier, leading to unexpected behavior or data corruption.

How do I fix a detected instance of Use of Multiple Resources with Duplicate Identifier in my codebase?

Implement unique identifiers and validate them before operating any resource, ensuring proper error handling for non-unique cases.

Vulnerabilities Related to Use of Multiple Resources with Duplicate Identifier

References

• MITRE - CWE-694
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Multiple Resources with Duplicate Identifier and other risks before an attacker does.