What is Not Using Complete Mediation (CWE-638)?

TL;DR: Not Using Complete Mediation (CWE-638) is a security flaw where access checks are bypassed, leading to unauthorized resource access. Fix by invalidating cached credentials when entity rights change.

What is Not Using Complete Mediation?

Not Using Complete Mediation (CWE-638) is a type of security vulnerability that occurs when access checks are not performed consistently on resources. As defined by the MITRE Corporation under CWE-638, this weakness can lead to unauthorized resource access and privilege escalation if entity rights change over time.

Quick Summary

Not Using Complete Mediation (CWE-638) is a security flaw where access checks are bypassed, leading to potential unauthorized access. This vulnerability compromises system integrity and data confidentiality, potentially resulting in financial losses and reputational damage. Jump to: What is Not Using Complete Mediation? · Quick Summary · Overview · How It Works · Business Impact · Attack Scenario · Detection · Fix · Framework Fixes · Ask AI · Best Practices Checklist · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Not Using Complete Mediation Overview · How Not Using Complete Mediation Works · Business Impact of Not Using Complete Mediation · Not Using Complete Mediation Attack Scenario · How to Detect Not Using Complete Mediation · How to Fix Not Using Complete Mediation · Framework-Specific Fixes for Not Using Complete Mediation · How to Ask AI to Check Your Code for Not Using Complete Mediation · Not Using Complete Mediation Best Practices Checklist · Not Using Complete Mediation FAQ · Vulnerabilities Related to Not Using Complete Mediation · References · Scan Your Own Site

Not Using Complete Mediation Overview

What: Not Using Complete Mediation occurs when access checks are not consistently performed on resources.

Why it matters: This can lead to unauthorized resource access and privilege escalation if entity rights change over time, compromising system integrity and data confidentiality.

Where it occurs: In applications that do not perform continuous access checks on sensitive resources.

Who is affected: Any application or system where access controls are bypassed due to inconsistent checks.

Who is NOT affected: Systems already using complete mediation mechanisms for consistent access control enforcement.

How Not Using Complete Mediation Works

Root Cause

The root cause of Not Using Complete Mediation lies in the failure to perform continuous access checks on resources, leading to potential unauthorized access if entity rights change over time.

Attack Flow

1. An attacker identifies a resource that is accessed without consistent checks.
2. The attacker manipulates the entity’s privileges or roles to gain higher-level access.
3. Unauthorized actions are performed due to bypassed access controls.

Prerequisites to Exploit

• Entity rights must be changeable over time.
• Access control mechanisms must not enforce continuous checks on resources.

Vulnerable Code

def access_resource(user, resource):
    if user.has_permission(resource):  # No check here after initial permission grant
        return True

This code does not perform any additional checks once the initial permission is granted, allowing unauthorized access if permissions change later.

Secure Code

def access_resource(user, resource):
    if user.has_current_permission(resource):  # Check performed every time
        return True

The secure version performs a current permission check each time the resource is accessed, ensuring consistent enforcement of access controls.

Business Impact of Not Using Complete Mediation

Confidentiality

• Example: Sensitive data can be read by unauthorized users if their permissions change.
• Consequences: Financial losses due to data breaches and reputational damage from leaked sensitive information.

Integrity

• Example: Unauthorized modifications can occur if entity rights are altered.
• Consequences: Data corruption leading to operational disruptions and loss of trust in the system’s integrity.

Availability

• Example: Resource access can be denied to legitimate users due to inconsistent checks.
• Consequences: Service interruptions affecting business continuity and customer satisfaction.

Not Using Complete Mediation Attack Scenario

1. The attacker identifies a resource that is accessed without continuous checks.
2. They manipulate the entity’s privileges or roles to gain higher-level access.
3. Unauthorized actions are performed, leading to data breaches or system disruptions.
4. The attack goes undetected due to inconsistent enforcement of access controls.

How to Detect Not Using Complete Mediation

Manual Testing

• Review code for consistent access checks on resources.
• Verify that permissions and roles are re-evaluated before each resource access attempt.

Automated Scanners (SAST / DAST)

Static analysis can identify code patterns where access checks are not consistently performed. Dynamic testing is required to validate actual runtime behavior.

PenScan Detection

PenScan’s scanner engines like ZAP, Wapiti, and Nikto actively test for this flaw by simulating various attack scenarios.

False Positive Guidance

A false positive occurs if the pattern appears risky but is actually safe due to context a scanner cannot detect. Ensure that access checks are indeed bypassed in practice.

How to Fix Not Using Complete Mediation

• Invalidate cached privileges, file handles, or other credentials whenever identities or permissions change.
• Avoid caching access control decisions as much as possible.
• Create and use a single interface for performing consistent access checks on sensitive resources.

Framework-Specific Fixes for Not Using Complete Mediation

Java

public boolean hasCurrentPermission(User user, Resource resource) {
    return securityManager.checkAccess(user, resource);
}

Node.js

function checkResourceAccess(user, resource) {
    if (user.hasCurrentPermission(resource)) {  // Check performed every time
        return true;
    }
}

Python/Django

def access_resource(request):
    user = request.user
    if user.has_current_permission(resource):  # Check performed each time
        return True

How to Ask AI to Check Your Code for Not Using Complete Mediation

Review the following [language] code block for potential CWE-638 Not Using Complete Mediation vulnerabilities and rewrite it using consistent access checks: [paste code here]

Not Using Complete Mediation Best Practices Checklist

✅ Invalidate cached privileges, file handles, or other credentials whenever identities or permissions change.

✅ Avoid caching access control decisions as much as possible.

✅ Create a single interface for performing consistent access checks on sensitive resources.

✅ Identify all possible code paths that might access sensitive resources and ensure they perform the necessary checks before caching data.

Not Using Complete Mediation FAQ

How does Not Using Complete Mediation work?

It occurs when a resource is accessed without performing access checks every time, leading to potential unauthorized access if the entity’s rights change over time.

Why should I be concerned about Not Using Complete Mediation?

This weakness can lead to data breaches and unauthorized system access, compromising confidentiality, integrity, and availability of resources.

How do I detect Not Using Complete Mediation in my application?

Use manual testing techniques such as code reviews and automated scanners like ZAP or Wapiti to identify instances where access checks are bypassed.

What is the primary fix for Not Using Complete Mediation?

Invalidate cached privileges, file handles, or other credentials whenever identities, processes, policies, roles, capabilities, or permissions change.

How can I prevent Not Using Complete Mediation in my application’s design phase?

Identify all possible code paths that access sensitive resources and create a single interface to perform the necessary access checks before caching data.

What are some real-world consequences of Not Using Complete Mediation?

It can result in unauthorized access, privilege escalation, and loss of sensitive information, leading to financial losses and reputational damage.

How does PenScan help detect Not Using Complete Mediation?

PenScan’s automated scanners like ZAP and Wapiti actively test for this flaw by simulating various attack scenarios.

Vulnerabilities Related to Not Using Complete Mediation

References

• MITRE CWE-638
• CAPEC-104
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Not Using Complete Mediation and other risks before an attacker does.