What is Truncation of Security-relevant (CWE-222)?

TL;DR: Truncation of Security-relevant Information (CWE-222) occurs when a product truncates the display, recording, or processing of security-related data in a way that obscures the source or nature of an attack. To prevent this vulnerability, ensure that all security-related data is properly processed and displayed without truncation.

At-a-Glance

What is Truncation of Security-relevant Information?

Truncation of security-relevant information occurs when a product truncates the display, recording, or processing of security-related data in a way that obscures the source or nature of an attack. As defined by the MITRE Corporation under CWE-222, and classified by the OWASP Foundation under A05:2021 - Security Misconfiguration, this vulnerability can have severe consequences.

Quick Summary

Truncation of security-relevant information is a critical security vulnerability that occurs when a product truncates the display, recording, or processing of security-related data in a way that obscures the source or nature of an attack. This can allow attacks to the system to continue without notice, making it difficult or impossible to determine the source of the attack.

Jump to: What is Truncation of Security-relevant Information? · Quick Summary · Truncation of Security-relevant Information Overview · How Truncation of Security-relevant Information Works · Business Impact of Truncation of Security-relevant Information · Truncation of Security-relevant Information Attack Scenario · How to Detect Truncation of Security-relevant Information · How to Fix Truncation of Security-relevant Information · Framework-Specific Fixes for Truncation of Security-relevant Information · How to Ask AI to Check Your Code for Truncation of Security-relevant Information · Truncation of Security-relevant Information Best Practices Checklist · Truncation of Security-relevant Information FAQ · Vulnerabilities Related to Truncation of Security-relevant Information · References · Scan Your Own Site

Truncation of Security-relevant Information Overview

What: Truncation of security-relevant information occurs when a product truncates the display, recording, or processing of security-related data in a way that obscures the source or nature of an attack.

Why it matters: The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

Where it occurs: Truncation of security-relevant information can occur in any system that handles sensitive data, including web applications, APIs, and databases.

Who is affected: Any user who interacts with a system that has been compromised by truncation of security-relevant information may be affected.

Who is NOT affected: Users who do not interact with the compromised system will not be affected.

How Truncation of Security-relevant Information Works

Root Cause

Truncation of security-relevant information occurs when a product truncates the display, recording, or processing of security-related data in a way that obscures the source or nature of an attack.

Attack Flow

1. An attacker sends a malicious request to the system.
2. The system processes the request and truncates the display, recording, or processing of security-related data.
3. The truncated data is displayed to the user, making it difficult or impossible to determine the source of the attack.

Prerequisites to Exploit

• The system must be vulnerable to truncation of security-relevant information.
• The attacker must have knowledge of the system’s vulnerabilities and how to exploit them.

Vulnerable Code

def process_request(request):
    # Truncate the display, recording, or processing of security-related data
    truncated_data = request.data[:10]
    return truncated_data

This code demonstrates a vulnerable example of truncation of security-relevant information. The process_request function truncates the display, recording, or processing of security-related data by only returning the first 10 characters of the request data.

Secure Code

def process_request(request):
    # Do not truncate the display, recording, or processing of security-related data
    return request.data

This code demonstrates a secure example of truncation of security-relevant information. The process_request function does not truncate the display, recording, or processing of security-related data by returning the entire request data.

Business Impact of Truncation of Security-relevant Information

Confidentiality: The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

• Financial impact: The financial impact of truncation of security-relevant information can be significant, as it can lead to data breaches and financial losses.
• Compliance impact: Truncation of security-relevant information can also have compliance implications, as it may not meet regulatory requirements for data protection.

Integrity: Truncation of security-relevant information can also compromise the integrity of the system.

• Financial impact: The financial impact of truncation of security-relevant information can be significant, as it can lead to data breaches and financial losses.
• Compliance impact: Truncation of security-relevant information can also have compliance implications, as it may not meet regulatory requirements for data protection.

Availability: Truncation of security-relevant information can also compromise the availability of the system.

• Financial impact: The financial impact of truncation of security-relevant information can be significant, as it can lead to data breaches and financial losses.
• Compliance impact: Truncation of security-relevant information can also have compliance implications, as it may not meet regulatory requirements for data protection.

Truncation of Security-relevant Information Attack Scenario

1. An attacker sends a malicious request to the system.
2. The system processes the request and truncates the display, recording, or processing of security-related data.
3. The truncated data is displayed to the user, making it difficult or impossible to determine the source of the attack.

How to Detect Truncation of Security-relevant Information

Manual Testing

• Review the system’s code for any instances of truncation of security-relevant information.
• Test the system with malicious requests to see if it truncates the display, recording, or processing of security-related data.

Automated Scanners (SAST / DAST)

• Use an automated scanner to identify any instances of truncation of security-relevant information in the system’s code.
• The scanner can also test the system with malicious requests to see if it truncates the display, recording, or processing of security-related data.

PenScan Detection

PenScan’s automated scanners can detect truncation of security-relevant information vulnerabilities in your web application.

False Positive Guidance

When reviewing the results of an automated scan, be sure to check for any false positives. A false positive may occur if the scanner identifies a legitimate instance of truncation of security-relevant information as a vulnerability.

How to Fix Truncation of Security-relevant Information

• Review the system’s code and remove any instances of truncation of security-relevant information.
• Test the system with malicious requests to ensure that it does not truncate the display, recording, or processing of security-related data.

Framework-Specific Fixes for Truncation of Security-relevant Information

This section will provide framework-specific fixes for truncation of security-relevant information. However, please note that these fixes may not be applicable to all systems and may require additional modifications.

C/C++

#include <stdio.h>

void process_request(char *request) {
    // Do not truncate the display, recording, or processing of security-related data
    printf("%s\n", request);
}

This code demonstrates a secure example of truncation of security-relevant information in C. The process_request function does not truncate the display, recording, or processing of security-related data by printing the entire request.

Java

public class ProcessRequest {
    public static void processRequest(String request) {
        // Do not truncate the display, recording, or processing of security-related data
        System.out.println(request);
    }
}

This code demonstrates a secure example of truncation of security-relevant information in Java. The processRequest function does not truncate the display, recording, or processing of security-related data by printing the entire request.

How to Ask AI to Check Your Code for Truncation of Security-relevant Information

You can ask an AI coding assistant to review your code for truncation of security-relevant information vulnerabilities. Here is a copy-pasteable prompt you can use:

Review the following Python code block for potential CWE-222 Truncation of Security-relevant Information vulnerabilities and rewrite it using secure coding practices:

def process_request(request):
    # Truncate the display, recording, or processing of security-related data
    truncated_data = request.data[:10]
    return truncated_data

Truncation of Security-relevant Information Best Practices Checklist

✅ Review your code for any instances of truncation of security-relevant information. ✅ Test your system with malicious requests to ensure that it does not truncate the display, recording, or processing of security-related data. ✅ Use secure coding practices to prevent truncation of security-relevant information.

Truncation of Security-relevant Information FAQ

How does truncation of security-relevant information occur?

Truncation of security-relevant information occurs when a product truncates the display, recording, or processing of security-related data in a way that obscures the source or nature of an attack.

What are the consequences of truncation of security-relevant information?

The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

How do I prevent truncation of security-relevant information?

To prevent truncation of security-relevant information, ensure that all security-related data is properly processed and displayed without truncation.

Can AI help me detect truncation of security-relevant information?

Yes, PenScan’s automated scanners can detect truncation of security-relevant information vulnerabilities in your web application.

What are the best practices for preventing truncation of security-relevant information?

Ensure that all security-related data is properly processed and displayed without truncation. Use secure coding practices to prevent truncation of security-relevant information.

How do I fix truncation of security-relevant information in my code?

To fix truncation of security-relevant information, ensure that all security-related data is properly processed and displayed without truncation. Use secure coding practices to prevent truncation of security-relevant information.

What are the related vulnerabilities to truncation of security-relevant information?

CWE-221: Information Loss or Omission (ChildOf)

Vulnerabilities Related to Truncation of Security-relevant Information

This table lists the related vulnerabilities to truncation of security-relevant information. CWE-221: Information Loss or Omission is a more specific variant of truncation of security-relevant information.

References

• https://cwe.mitre.org/data/definitions/222.html (MITRE)
• https://capec.mitre.org/data/definitions/CAPEC-123.html (CAPEC)
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find truncation of security-relevant information and other risks before an attacker does.