What is Use of Low-Level Functionality (CWE-695)?

TL;DR: Use of Low-Level Functionality (CWE-695) is a security vulnerability that occurs when an application uses prohibited low-level functionality, leading to potential risks. Fix it by replacing low-level functions with higher-level abstractions or implementing robust input validation.

What is Use of Low-Level Functionality?

Use of Low-Level Functionality (CWE-695) is a type of vulnerability that occurs when an application uses low-level functionality explicitly prohibited by the framework or specification under which it operates. As defined by the MITRE Corporation under CWE-695, and classified by the OWASP Foundation as not directly mapped to any specific category.

Quick Summary

Use of Low-Level Functionality is a serious security issue that can lead to various types of attacks compromising data integrity and confidentiality. It matters because it exposes systems to vulnerabilities that could be exploited by attackers. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · AI Check · Best Practices · FAQ

Jump to: Quick Summary · Use of Low-Level Functionality Overview · How Use of Low-Level Functionality Works · Business Impact of Use of Low-Level Functionality · Use of Low-Level Functionality Attack Scenario · How to Detect Use of Low-Level Functionality · How to Fix Use of Low-Level Functionality · Framework-Specific Fixes for Use of Low-Level Functionality · How to Ask AI to Check Your Code for Use of Low-Level Functionality · Use of Low-Level Functionality Best Practices Checklist · Use of Low-Level Functionality FAQ · Vulnerabilities Related to Use of Low-Level Functionality · References · Scan Your Own Site

Use of Low-Level Functionality Overview

What: Use of Low-Level Functionality is a vulnerability where an application uses low-level functions that are prohibited by the framework or specification.

Why it matters: This can lead to security vulnerabilities and expose systems to various types of attacks, compromising data integrity and confidentiality.

Where it occurs: It commonly occurs in applications that use low-level functions without proper validation or abstraction layers.

Who is affected: Any application using low-level functionality prohibited by its framework or specification.

Who is NOT affected: Applications that follow the high-level abstractions provided by their frameworks and do not use prohibited low-level functions.

How Use of Low-Level Functionality Works

Root Cause

The root cause is when an application uses low-level functionality that violates the framework’s specifications, leading to potential security vulnerabilities.

Attack Flow

1. An attacker identifies a low-level function being used in the application.
2. The attacker manipulates input to exploit the prohibited low-level function.
3. This leads to unauthorized access or other malicious activities.

Prerequisites to Exploit

• Application uses a low-level function that is explicitly prohibited by its framework.
• Input can be manipulated to trigger the vulnerability.

Vulnerable Code

def change_directory(path):
    os.chdir(path)

This code allows an attacker to manipulate the path input and change directories, potentially leading to unauthorized access.

Secure Code

def change_directory(base_dir, path):
    if not os.path.abspath(path).startswith(base_dir):
        raise ValueError("Path is outside of allowed directory")
    os.chdir(path)

This secure code ensures that the path input is validated before changing directories, preventing unauthorized access.

Business Impact of Use of Low-Level Functionality

Confidentiality: Data confidentiality can be compromised if an attacker gains unauthorized access to sensitive information.

• Example: An attacker changes directory and accesses confidential files.

Integrity: System integrity can be compromised through malicious file operations or data manipulation.

• Example: An attacker modifies system configurations leading to unstable operation.

Availability: The availability of the application may be disrupted by denial-of-service attacks exploiting low-level functions.

• Example: An attacker causes a service outage by manipulating input to crash the application.

Business Consequences:

1. Financial loss due to downtime and data breaches.
2. Compliance issues with regulatory requirements like GDPR or HIPAA.
3. Damage to reputation from publicized security incidents.

Use of Low-Level Functionality Attack Scenario

1. The attacker identifies a low-level function being used in the application, such as os.chdir(path).
2. They manipulate input by providing an unauthorized directory path.
3. This triggers the vulnerability and changes the working directory.
4. Unauthorized access to sensitive files or directories is achieved.

How to Detect Use of Low-Level Functionality

Manual Testing

• Review code for usage of low-level functions prohibited by framework specifications.
• Check if proper input validation is implemented before using such functions.

Automated Scanners (SAST/DAST)

Static analysis can detect the presence of prohibited low-level functions. Dynamic testing can confirm vulnerabilities in real-world scenarios.

PenScan Detection

PenScan’s scanner engines like ZAP and Nuclei can identify potential Use of Low-Level Functionality issues.

• Example: ZAP flags usage of os.chdir(path) without proper validation.

False Positive Guidance

A true positive is when a low-level function is used without proper validation. A false positive occurs if the function is correctly validated or not prohibited by the framework.

How to Fix Use of Low-Level Functionality

• Replace low-level functions with higher-level abstractions.
• Implement robust input validation before using low-level functions.
• Follow high-level abstractions provided by frameworks and specifications.
• Ensure all inputs are properly sanitized and validated.

Framework-Specific Fixes for Use of Low-Level Functionality

Python/Django

def change_directory(base_dir, path):
    if not os.path.abspath(path).startswith(base_dir):
        raise ValueError("Path is outside of allowed directory")
    os.chdir(path)

This secure code ensures that the path input is validated before changing directories.

How to Ask AI to Check Your Code for Use of Low-Level Functionality

Review the following Python code block for potential CWE-695 Use of Low-Level Functionality vulnerabilities and rewrite it using proper validation techniques:

def change_directory(path):
    os.chdir(path)

Use of Low-Level Functionality Best Practices Checklist

✅ Follow high-level abstractions provided by frameworks. ✅ Implement robust input validation before using low-level functions. ✅ Replace prohibited low-level functions with higher-level alternatives. ✅ Regularly review code for adherence to framework specifications.

Use of Low-Level Functionality FAQ

How does Use of Low-Level Functionality occur?

It occurs when a product uses low-level functionality that is explicitly prohibited by the framework or specification under which it operates, leading to potential security vulnerabilities.

Why should I be concerned about Use of Low-Level Functionality in my application?

This vulnerability can expose your system to various types of attacks and compromise data integrity and confidentiality.

Can you provide an example of vulnerable code for Use of Low-Level Functionality?

A common example is using a low-level function like os.chdir(path) without proper validation, allowing an attacker to manipulate the directory path.

How can I detect Use of Low-Level Functionality in my application?

manual testing steps automated scanners (sast/dast) penScan detection false positive guidance

What are some best practices for preventing Use of Low-Level Functionality?

Implement robust validation mechanisms and use high-level functions that abstract away low-level details to prevent misuse.

How can I fix Use of Low-Level Functionality once it is detected in my codebase?

Replace the low-level function with a higher-level abstraction or ensure proper input validation before using the low-level functionality.

What are some common mistakes developers make when trying to mitigate Use of Low-Level Functionality?

Developers often rely on simple denylist checks instead of comprehensive validation, which can be easily bypassed by attackers.

Vulnerabilities Related to Use of Low-Level Functionality

| CWE | Name | Relationship | |—|—|—| | 573 | Improper Following of Specification by Caller (ChildOf) |

References

• MITRE
• CAPEC-36
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Low-Level Functionality and other risks before an attacker does.