目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-99 对资源描述符的控制不恰当(资源注入) 类漏洞列表 72

CWE-99 对资源描述符的控制不恰当(资源注入) 类弱点 72 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-99 属于资源注入漏洞，指程序未充分校验上游输入，直接将其用作外部资源标识符。攻击者通常通过构造恶意输入，操纵资源访问路径以读取或修改非授权文件、数据库记录等敏感数据。开发者应避免此问题，需对输入进行严格的白名单验证，使用参数化查询或安全API，确保资源标识符在预期控制范围内，从而阻断非法访问。

MITRE CWE 官方描述
CWE：CWE-99 资源标识符控制不当（'Resource Injection'） 英文：产品从上游组件接收输入，但在将其用作可能超出预期控制范围的资源的标识符之前，未对输入进行限制或限制不正确。 当满足以下两个条件时，会发生资源注入（Resource Injection）问题：攻击者可以指定用于访问系统资源的标识符。例如，攻击者可能能够指定要打开的文件名的一部分或要使用的端口号。通过指定资源，攻击者获得了原本不被允许的能力。例如，程序可能赋予攻击者覆盖指定文件、使用由攻击者控制的配置运行或将敏感信息传输到第三方服务器的能力。这可能使攻击者能够访问或修改原本受保护的系统资源。
常见影响 (1)
Confidentiality, Integrity Read Application Data, Modify Application Data, Read Files or Directories, Modify Files or Directories
An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information.
缓解措施 (1)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
The following Java code uses input from an HTTP request to create a file name. The programmer has not considered the possibility that an attacker could provide a file name such as "../../tomcat/conf/server.xml", which causes the application to delete one of its own configuration files.
String rName = request.getParameter("reportName"); File rFile = new File("/usr/local/apfr/reports/" + rName); ... rFile.delete();
Bad · Java
The following code uses input from the command line to determine which file to open and echo back to the user. If the program runs with privileges and malicious users can create soft links to the file, they can use the program to read the first part of any file on the system.
ifstream ifs(argv[0]); string s; ifs >> s; cout << s;
Bad · C++
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-2980 Abstrium Pydio Cells 安全漏洞 — Pydio Cells 6.3 Medium 2023-05-30
CVE-2022-39369 Apereo CAS 安全漏洞 — phpCAS 8.0 High 2022-11-01
CVE-2022-3774 Train Scheduler App 安全漏洞 — Train Scheduler App 5.4 Medium 2022-10-31
CVE-2022-27670 SAP SQL Anywhere 安全漏洞 — SAP SQL Anywhere Server 6.5 - 2022-04-12
CVE-2022-1287 School Club Application System 注入漏洞 — School Club Application System 6.5 Medium 2022-04-09
CVE-2021-22879 Nextcloud 注入漏洞 — Nextcloud Desktop Client 8.8 - 2021-04-14
CVE-2020-8177 Haxx curl 注入漏洞 — https://github.com/curl/curl 7.3 - 2020-12-14
CVE-2020-6245 SAP Business Objects Business Intelligence Platform 注入漏洞 — SAP Business Objects Business Intelligence Platform 7.8 - 2020-05-12
CVE-2020-5230 Apereo Opencast 注入漏洞 — opencast 7.7 High 2020-01-30
CVE-2019-1860 Cisco Unified Intelligence Center 安全漏洞 — Cisco Unified Intelligence Center 5.9 - 2019-05-16
CVE-2019-6545 AVEVA InTouch Edge HMI 安全漏洞 — AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update 9.1 - 2019-02-13
CVE-2016-8615 Haxx curl 安全漏洞 — curl 5.3 - 2018-08-01

CWE-99（对资源描述符的控制不恰当(资源注入)） 是常见的弱点类别，本平台收录该类弱点关联的 72 条 CVE 漏洞。