What is Obscured Security-relevant Information (CWE-224)?

TL;DR: Obscured Security-relevant Information by Alternate Name (CWE-224) occurs when a product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name. You can fix this issue by removing alternate names, using canonical names, and validating input.

What is Obscured Security-relevant Information by Alternate Name?

Obscured Security-relevant Information by Alternate Name (CWE-224) is a type of vulnerability that occurs when a product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name. As defined by the MITRE Corporation under CWE-224, and classified by the OWASP Foundation under None, this vulnerability can lead to significant security risks.

Quick Summary

Obscured Security-relevant Information by Alternate Name (CWE-224) is a type of vulnerability that occurs when a product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name. This vulnerability can lead to Hide Activities and Gain Privileges or Assume Identity, making it a significant security risk. You can detect this issue using manual testing, automated scanners (SAST/DAST), PenScan detection, and false positive guidance.

Jump to: Quick Summary · Obscured Security-relevant Information by Alternate Name Overview · How Obscured Security-relevant Information by Alternate Name Works · Business Impact of Obscured Security-relevant Information by Alternate Name · Obscured Security-relevant Information by Alternate Name Attack Scenario · How to Detect Obscured Security-relevant Information by Alternate Name · How to Fix Obscured Security-relevant Information by Alternate Name · Framework-Specific Fixes for Obscured Security-relevant Information by Alternate Name · How to Ask AI to Check Your Code for Obscured Security-relevant Information by Alternate Name · Obscured Security-relevant Information by Alternate Name Best Practices Checklist · Obscured Security-relevant Information by Alternate Name FAQ · Vulnerabilities Related to Obscured Security-relevant Information by Alternate Name · References · Scan Your Own Site

Obscured Security-relevant Information by Alternate Name Overview

What

Obscured Security-relevant Information by Alternate Name (CWE-224) occurs when a product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

Why it matters

This vulnerability can lead to Hide Activities and Gain Privileges or Assume Identity, making it a significant security risk.

Where it occurs

This vulnerability can occur in any product that records security-relevant information, including web applications, web services, and APIs.

Who is affected

Any product that uses alternate names instead of canonical names is affected by this vulnerability.

Who is NOT affected

Products that use canonical names are not affected by this vulnerability.

How Obscured Security-relevant Information by Alternate Name Works

Root Cause

The root cause of this vulnerability is the use of alternate names instead of canonical names to record security-relevant information.

Attack Flow

1. The attacker uses an alternate name to access a sensitive resource.
2. The product records the security-relevant information using the alternate name, instead of the canonical name.
3. The attacker gains access to the sensitive resource and can perform malicious activities.

Prerequisites to Exploit

The prerequisites to exploit this vulnerability are:

• The product uses alternate names instead of canonical names.
• The attacker has knowledge of the alternate name used by the product.

Vulnerable Code

import os

def record_security_relevant_info(name):
    # Record security-relevant information using an alternate name
    with open('/tmp/security_info', 'w') as f:
        f.write(name)

This code demonstrates a vulnerable example of recording security-relevant information using an alternate name.

Secure Code

import os

def record_security_relevant_info(name):
    # Record security-relevant information using the canonical name
    with open('/tmp/security_info', 'w') as f:
        f.write(os.path.basename(name))

This code demonstrates a secure example of recording security-relevant information using the canonical name.

Business Impact of Obscured Security-relevant Information by Alternate Name

Confidentiality

The confidentiality impact of this vulnerability is Hide Activities, which can lead to unauthorized access to sensitive resources.

Integrity

The integrity impact of this vulnerability is Gain Privileges or Assume Identity, which can lead to malicious activities being performed on the system.

Availability

The availability impact of this vulnerability is not applicable.

Obscured Security-relevant Information by Alternate Name Attack Scenario

1. The attacker uses an alternate name to access a sensitive resource.
2. The product records the security-relevant information using the alternate name, instead of the canonical name.
3. The attacker gains access to the sensitive resource and can perform malicious activities.

How to Detect Obscured Security-relevant Information by Alternate Name

Manual Testing

Manual testing involves reviewing the code for any instances of recording security-relevant information using alternate names.

Automated Scanners (SAST/DAST)

Automated scanners can detect this vulnerability by analyzing the code and identifying any instances of recording security-relevant information using alternate names.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

False positives can occur when a product uses canonical names, but the scanner identifies an alternate name due to a configuration error. In such cases, it is essential to review the code and configuration carefully to determine whether the issue is a false positive or not.

How to Fix Obscured Security-relevant Information by Alternate Name

• Remove alternate names from the product’s configuration.
• Use canonical names instead of alternate names to record security-relevant information.
• Validate input to ensure that only canonical names are used.

Framework-Specific Fixes for Obscured Security-relevant Information by Alternate Name

Python/Django

import os

def record_security_relevant_info(name):
    # Record security-relevant information using the canonical name
    with open('/tmp/security_info', 'w') as f:
        f.write(os.path.basename(name))

Java

public class SecurityRelevantInfo {
    public static void recordSecurityRelevantInfo(String name) {
        // Record security-relevant information using the canonical name
        try (FileWriter writer = new FileWriter("/tmp/security_info")) {
            writer.write(new File(name).getName());
        } catch (IOException e) {
            System.err.println("Error recording security-relevant info: " + e.getMessage());
        }
    }
}

PHP

function record_security_relevant_info($name) {
    // Record security-relevant information using the canonical name
    $fp = fopen('/tmp/security_info', 'w');
    fwrite($fp, basename($name));
    fclose($fp);
}

How to Ask AI to Check Your Code for Obscured Security-relevant Information by Alternate Name

You can ask AI to check your code for Obscured Security-relevant Information by Alternate Name using a copy-pasteable prompt:

Review the following Python/Django code block for potential CWE-224 Obscured Security-relevant Information by Alternate Name vulnerabilities and rewrite it using canonical names:

Obscured Security-relevant Information by Alternate Name Best Practices Checklist

✅ Use canonical names instead of alternate names to record security-relevant information. ✅ Validate input to ensure that only canonical names are used. ✅ Remove alternate names from the product’s configuration.

Obscured Security-relevant Information by Alternate Name FAQ

How does Obscured Security-relevant Information by Alternate Name occur?

Obscured Security-relevant Information by Alternate Name occurs when a product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

What are the common consequences of Obscured Security-relevant Information by Alternate Name?

The common consequences of Obscured Security-relevant Information by Alternate Name include Hide Activities and Gain Privileges or Assume Identity.

How can I detect Obscured Security-relevant Information by Alternate Name?

You can detect Obscured Security-relevant Information by Alternate Name using manual testing, automated scanners (SAST/DAST), PenScan detection, and false positive guidance.

What are the potential mitigations for Obscured Security-relevant Information by Alternate Name?

The potential mitigations for Obscured Security-relevant Information by Alternate Name include removing alternate names, using canonical names, and validating input.

How can I prevent Obscured Security-relevant Information by Alternate Name?

You can prevent Obscured Security-relevant Information by Alternate Name by following best practices such as using canonical names, validating input, and removing alternate names.

What are the related weaknesses to Obscured Security-relevant Information by Alternate Name?

The related weaknesses to Obscured Security-relevant Information by Alternate Name include CWE-221: Information Loss or Omission (ChildOf).

How can I ask AI to check my code for Obscured Security-relevant Information by Alternate Name?

You can ask AI to check your code for Obscured Security-relevant Information by Alternate Name using a copy-pasteable prompt.

Vulnerabilities Related to Obscured Security-relevant Information by Alternate Name

References

• CWE-224
• None
• None
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Obscured Security-relevant Information by Alternate Name and other risks before an attacker does.