What is Use of Incorrectly-Resolved Name (CWE-706)?

TL;DR: Use of Incorrectly-Resolved Name or Reference (CWE-706) is a vulnerability where improper validation of resource names leads to unauthorized access and data breaches.

What is Use of Incorrectly-Resolved Name or Reference?

Use of Incorrectly-Resolved Name or Reference (CWE-706) is a type of vulnerability that occurs when a resource name or reference resolves to an unintended location, often due to insufficient validation. As defined by the MITRE Corporation under CWE-706, and classified by the OWASP Foundation under [mapping]…

Quick Summary

Use of Incorrectly-Resolved Name or Reference vulnerabilities can lead to unauthorized access to sensitive data and disruption of system availability. They are critical because they allow attackers to manipulate resource references in ways that bypass intended security controls.

Jump to: Quick Summary · Use of Incorrectly-Resolved Name or Reference Overview · How Use of Incorrectly-Resolved Name or Reference Works · Business Impact of Use of Incorrectly-Resolved Name or Reference · Use of Incorrectly-Resolved Name or Reference Attack Scenario · How to Detect Use of Incorrectly-Resolved Name or Reference · How to Fix Use of Incorrectly-Resolved Name or Reference · Framework-Specific Fixes for Use of Incorrectly-Resolved Name or Reference · How to Ask AI to Check Your Code for Use of Incorrectly-Resolved Name or Reference · Use of Incorrectly-Resolved Name or Reference Best Practices Checklist · Use of Incorrectly-Resolved Name or Reference FAQ · Vulnerabilities Related to Use of Incorrectly-Resolved Name or Reference · References · Scan Your Own Site

Use of Incorrectly-Resolved Name or Reference Overview

What

Use of Incorrectly-Resolved Name or Reference occurs when a resource name or reference resolves to an unintended location due to insufficient validation.

Why it matters

This vulnerability can lead to unauthorized access, data breaches, and system disruptions by allowing attackers to manipulate resource references in ways that bypass intended security controls.

Where it occurs

It commonly affects applications and systems where external inputs are used to construct resource names or references without proper validation.

Who is affected

Developers and organizations relying on unvalidated resource identifiers are at risk of this vulnerability.

Who is NOT affected

Systems with strict validation mechanisms for resource names and references, and those that do not accept user-controlled input for such purposes.

How Use of Incorrectly-Resolved Name or Reference Works

Root Cause

The root cause lies in insufficient validation and verification of resource names or references before they are used.

Attack Flow

1. An attacker inputs a crafted resource name or reference.
2. The application processes the input without proper validation.
3. The resource is accessed, leading to unauthorized actions.
4. Sensitive data may be read or modified.

   Prerequisites to Exploit

   • External control over resource names or references.
   • Lack of validation for these identifiers.

     Vulnerable Code

     resource_name = request.form['name']
     os.system(f'rm {resource_name}')
     

     This code is vulnerable because it directly uses an unvalidated user input to construct a command, allowing attackers to manipulate the resource name.

Secure Code

allowed_resources = ['file1.txt', 'file2.txt']
if resource_name in allowed_resources:
    os.system(f'rm {resource_name}')
else:
    raise ValueError('Invalid resource name')

The secure version ensures that only predefined and trusted resource names are processed, preventing unauthorized access.

Business Impact of Use of Incorrectly-Resolved Name or Reference

Confidentiality

• Attackers can read sensitive data stored in unintended locations.
• Potential for data breaches leading to loss of confidential information.

  Integrity

• Unauthorized modification of application data through manipulated references.
• Compromise of system integrity and reliability.

  Availability

• Disruption of service due to resource mismanagement or denial-of-service attacks.

Use of Incorrectly-Resolved Name or Reference Attack Scenario

1. An attacker inputs a crafted resource name that points to a sensitive file.
2. The application processes this input without validation.
3. The attacker triggers the deletion of the sensitive file.
4. Sensitive data is lost, leading to potential business disruption.

How to Detect Use of Incorrectly-Resolved Name or Reference

Manual Testing

• Review code for direct use of unvalidated user inputs in resource names or references.
• Verify that all resource identifiers are validated against a whitelist before use.

  Automated Scanners (SAST/DAST)

  Static analysis can detect patterns where user inputs directly influence resource names. Dynamic testing is needed to confirm actual exploitation scenarios.

  PenScan Detection

  PenScan’s scanner engines like ZAP, Nuclei, Wapiti, and Nikto can identify this vulnerability by analyzing code patterns and configurations that may lead to incorrect resolution.

  False Positive Guidance

  False positives often occur when resource names are constructed from trusted inputs or in contexts where validation is already performed.

How to Fix Use of Incorrectly-Resolved Name or Reference

• Implement strict validation rules for all resource identifiers before use.
• Use secure coding standards and best practices for handling external inputs.
• Regularly audit application logic related to resource management.

Framework-Specific Fixes for Use of Incorrectly-Resolved Name or Reference

def validate_resource_name(name):
    allowed_resources = ['file1.txt', 'file2.txt']
    if name not in allowed_resources:
        raise ValueError('Invalid resource name')
    return name

resource_name = validate_resource_name(request.form['name'])
os.system(f'rm {resource_name}')

How to Ask AI to Check Your Code for Use of Incorrectly-Resolved Name or Reference

Use of Incorrectly-Resolved Name or Reference Best Practices Checklist

✅ Implement strict validation rules for all resource identifiers. ✅ Regularly audit application logic related to resource management. ✅ Use secure coding standards and best practices for handling external inputs.

Use of Incorrectly-Resolved Name or Reference FAQ

How does Use of Incorrectly-Resolved Name or Reference occur?

It occurs when a resource name or reference resolves to an unintended location, often due to insufficient validation.

What are the consequences of Use of Incorrectly-Resolved Name or Reference?

Attackers can read or modify sensitive data and disrupt system availability by exploiting this vulnerability.

How does Use of Incorrectly-Resolved Name or Reference impact confidentiality?

It allows unauthorized access to confidential information, leading to potential data breaches.

What is the root cause of Use of Incorrectly-Resolved Name or Reference?

The primary cause is inadequate validation and verification of resource names or references before use.

How can developers detect Use of Incorrectly-Resolved Name or Reference in their codebase?

Developers should manually review code for improper handling of resource identifiers and use automated tools to scan for patterns indicative of this vulnerability.

What are the best practices to prevent Use of Incorrectly-Resolved Name or Reference?

Implement strict validation rules, use secure coding standards, and regularly audit your application’s resource management logic.

How can PenScan help in identifying Use of Incorrectly-Resolved Name or Reference vulnerabilities?

PenScan’s automated scanners can detect this vulnerability by analyzing code patterns and configurations that may lead to incorrect resolution.

Vulnerabilities Related to Use of Incorrectly-Resolved Name or Reference

| CWE | Name | Relationship | |—|—|—| | CWE-664 | Improper Control of a Resource Through its Lifetime (ChildOf) | | CWE-99 | Improper Control of Resource Identifiers (‘Resource Injection’) (PeerOf) |

References

• MITRE
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Incorrectly-Resolved Name or Reference and other risks before an attacker does.