Book a Security Review

Weakness · High

CWE-506: Embedded Malicious Code

What it is

The product contains code that appears to be malicious in nature.

8 exploited in the wildMITRE CWE 4.19.1

Severity (our rating)
High
Likelihood of exploit
Not rated by MITRE
Introduced during
Bundling, Distribution, Implementation, Installation
Exploited in the wild
8 known exploited CVEs

In more detail

Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.

What an attacker can do

  • Execute Unauthorized Code or Commands (Confidentiality, Integrity, Availability)

How to prevent it

Testing

  • Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

How to find it

  • Manual Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies Generated Code Inspection
  • Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Automated Monitored Execution
  • Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Manual Source Code Review (not inspections)
  • Automated Static Analysis. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Origin Analysis

CWE-506 on MITRE's CWE site

Exploited in the wild: 8 CVEs

Vulnerabilities caused by CWE-506 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.

All known exploited vulnerabilities

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.