What is Use of Less Trusted Source (CWE-348)?

TL;DR: Use of Less Trusted Source (CWE-348) is a vulnerability that occurs when a product relies on an untrusted source for data or information, potentially leading to security vulnerabilities. It can be fixed by using secure libraries and frameworks, validating user input, and implementing access control mechanisms.

What is Use of Less Trusted Source?

Use of Less Trusted Source (CWE-348) is a type of vulnerability that occurs when a product relies on an untrusted source for data or information, potentially leading to security vulnerabilities. As defined by the MITRE Corporation under CWE-348, and classified by the OWASP Foundation under A05:2025, this vulnerability can have significant consequences.

Quick Summary

Use of Less Trusted Source (CWE-348) is a high-severity vulnerability that occurs when a product relies on an untrusted source for data or information. This can lead to bypassing protection mechanisms and gaining privileges or assuming identity. It is essential to use secure libraries and frameworks, validate user input, and implement access control mechanisms to prevent this vulnerability.

Jump to: Quick Summary · Use of Less Trusted Source Overview · How Use of Less Trusted Source Works · Business Impact of Use of Less Trusted Source · Use of Less Trusted Source Attack Scenario · How to Detect Use of Less Trusted Source · How to Fix Use of Less Trusted Source · Framework-Specific Fixes for Use of Less Trusted Source · How to Ask AI to Check Your Code for Use of Less Trusted Source · Use of Less Trusted Source Best Practices Checklist · Use of Less Trusted Source FAQ · Vulnerabilities Related to Use of Less Trusted Source · References · Scan Your Own Site

Use of Less Trusted Source Overview

• What: Use of Less Trusted Source (CWE-348) is a type of vulnerability that occurs when a product relies on an untrusted source for data or information.
• Why it matters: This vulnerability can lead to bypassing protection mechanisms and gaining privileges or assuming identity.
• Where it occurs: Use of Less Trusted Source can occur in web applications, APIs, and databases.
• Who is affected: Any organization that uses web applications, APIs, or databases is potentially affected by this vulnerability.
• Who is NOT affected: Organizations that do not use web applications, APIs, or databases are not affected by this vulnerability.

How Use of Less Trusted Source Works

Root Cause

The root cause of Use of Less Trusted Source (CWE-348) is the reliance on an untrusted source for data or information. This can be due to various reasons such as using user input or external APIs without proper validation.

Attack Flow

1. An attacker sends a request to the vulnerable application.
2. The application relies on an untrusted source for data or information, potentially leading to security vulnerabilities.
3. The attacker exploits the vulnerability to gain privileges or assume identity.

Prerequisites to Exploit

• The application must rely on an untrusted source for data or information.
• The attacker must be able to send a request to the vulnerable application.
• The application must not have proper validation mechanisms in place.

Vulnerable Code

import requests

def get_data():
    url = "https://example.com/api/data"
    response = requests.get(url)
    data = response.json()
    return data

This code is vulnerable because it relies on an external API without proper validation.

Secure Code

import requests

def get_data():
    url = "https://example.com/api/data"
    headers = {"Authorization": "Bearer YOUR_API_KEY"}
    response = requests.get(url, headers=headers)
    data = response.json()
    return data

This code is secure because it uses proper validation mechanisms and authenticates with the API.

Business Impact of Use of Less Trusted Source

The business impact of Use of Less Trusted Source (CWE-348) can be significant. It can lead to:

• Bypassing protection mechanisms and gaining privileges or assuming identity.
• Data breaches and unauthorized access.
• Financial losses due to data theft or manipulation.
• Reputation damage due to security vulnerabilities.

Use of Less Trusted Source Attack Scenario

1. An attacker sends a request to the vulnerable application.
2. The application relies on an untrusted source for data or information, potentially leading to security vulnerabilities.
3. The attacker exploits the vulnerability to gain privileges or assume identity.

How to Detect Use of Less Trusted Source

Manual Testing

• Review code for patterns that indicate reliance on untrusted sources.
• Test the application with malicious input to see if it can be exploited.

Automated Scanners (SAST/DAST)

• Use static analysis tools to identify potential vulnerabilities in code.
• Use dynamic testing tools to simulate attacks and identify vulnerabilities.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• Be cautious of false positives due to similar-looking code patterns.
• Verify the findings with manual testing or additional automated scans.

How to Fix Use of Less Trusted Source

• Use secure libraries and frameworks that provide proper validation mechanisms.
• Implement access control mechanisms to restrict unauthorized access.
• Validate user input to prevent reliance on untrusted sources.

Framework-Specific Fixes for Use of Less Trusted Source

Java

import java.util.HashMap;
import java.util.Map;

public class DataRetriever {
    public Map<String, String> getData() {
        // Use secure libraries and frameworks that provide proper validation mechanisms.
        // Implement access control mechanisms to restrict unauthorized access.
        return dataMap;
    }
}

Node.js

const axios = require('axios');

async function getData() {
    try {
        const response = await axios.get('https://example.com/api/data');
        const data = response.data;
        // Use secure libraries and frameworks that provide proper validation mechanisms.
        // Implement access control mechanisms to restrict unauthorized access.
        return data;
    } catch (error) {
        console.error(error);
    }
}

Python/Django

import requests

def get_data():
    try:
        response = requests.get('https://example.com/api/data')
        data = response.json()
        # Use secure libraries and frameworks that provide proper validation mechanisms.
        # Implement access control mechanisms to restrict unauthorized access.
        return data
    except Exception as e:
        print(e)

PHP

<?php
function getData() {
    try {
        $response = file_get_contents('https://example.com/api/data');
        $data = json_decode($response, true);
        // Use secure libraries and frameworks that provide proper validation mechanisms.
        // Implement access control mechanisms to restrict unauthorized access.
        return $data;
    } catch (Exception $e) {
        print($e->getMessage());
    }
}

How to Ask AI to Check Your Code for Use of Less Trusted Source

Review the following [language] code block for potential CWE-348 Use of Less Trusted Source vulnerabilities and rewrite it using proper validation mechanisms:

import requests

def get_data():
    url = "https://example.com/api/data"
    response = requests.get(url)
    data = response.json()
    return data

Use of Less Trusted Source Best Practices Checklist

✅ Review code for patterns that indicate reliance on untrusted sources. ✅ Implement access control mechanisms to restrict unauthorized access. ✅ Validate user input to prevent reliance on untrusted sources.

Use of Less Trusted Source FAQ

How is Use of Less Trusted Source defined?

Use of Less Trusted Source (CWE-348) is a type of vulnerability that occurs when a product relies on an untrusted source for data or information, potentially leading to security vulnerabilities.

What are the common consequences of Use of Less Trusted Source?

The common consequences of Use of Less Trusted Source include bypassing protection mechanisms and gaining privileges or assuming identity.

How does Use of Less Trusted Source occur in real-world scenarios?

Use of Less Trusted Source can occur when a web application relies on an untrusted source for data, such as user input or external APIs.

What are the typical severity levels associated with Use of Less Trusted Source?

The typical severity levels associated with Use of Less Trusted Source vary depending on the exploitability and impact of the vulnerability.

How can Use of Less Trusted Source be detected in code?

Use of Less Trusted Source can be detected by analyzing code for patterns that indicate reliance on untrusted sources, such as user input or external APIs.

What are some common framework-specific fixes for Use of Less Trusted Source?

Some common framework-specific fixes for Use of Less Trusted Source include using secure libraries and frameworks, validating user input, and implementing access control mechanisms.

How can AI be used to check code for Use of Less Trusted Source vulnerabilities?

AI can be used to analyze code for patterns that indicate reliance on untrusted sources, such as user input or external APIs.

Vulnerabilities Related to Use of Less Trusted Source

References

• https://cwe.mitre.org/data/definitions/348.html
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Less Trusted Source and other risks before an attacker does.