Scribd Logo
Upload

Welcome to Scribd!

  • 22 views

    CWE - CWE-840 - Business Logic Errors (4.15)

    Uploaded by

    Vinay

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CWE - CWE-840 - Business Logic Errors (4.15)

    Uploaded by

    Vinay
    22 views2 pages

    Original Title

    CWE - CWE-840_ Business Logic Errors (4.15)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    22 views2 pages

    CWE - CWE-840 - Business Logic Errors (4.15)

    Uploaded by

    Vinay

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 2

    Common Weakness Enumeration

    A community-developed list of SW & HW weaknesses that


    can become vulnerabilities

    Home About ▼ CWE List ▼ Mapping ▼ Top-N Lists ▼ Community ▼ News ▼ Search

    CWE CATEGORY: Business Logic Errors


    Category ID: 840
    Vulnerability Mapping: PROHIBITED

    Summary
    Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the
    business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to
    find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic
    errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
    Membership

    Nature Type ID Name


    MemberOf 699 Software Development
    MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure Design
    HasMember 283 Unverified Ownership
    HasMember 639 Authorization Bypass Through User-Controlled Key
    HasMember 640 Weak Password Recovery Mechanism for Forgotten Password
    HasMember 708 Incorrect Ownership Assignment
    HasMember 770 Allocation of Resources Without Limits or Throttling
    HasMember 826 Premature Release of Resource During Expected Lifetime
    HasMember 837 Improper Enforcement of a Single, Unique Action
    HasMember 841 Improper Enforcement of Behavioral Workflow

    Vulnerability Mapping Notes

    Usage: PROHIBITED (this CWE ID must not be used to map to real-world vulnerabilities)

    Reason: Category

    Rationale:

    This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal
    organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing.
    However, they are not weaknesses in themselves.
    Comments:

    See member weaknesses of this category.


    Notes
    Terminology
    The "Business Logic" term is generally used to describe issues that require domain-specific knowledge or "business
    rules" to determine if they are weaknesses or vulnerabilities, instead of legitimate behavior. Such issues might not be
    easily detectable via automatic code analysis, because the associated operations do not produce clear errors or
    undefined behavior at the code level. However, many such "business logic" issues can be understood as instances of
    other weaknesses such as input validation, access control, numeric computation, order of operations, etc.
    Research Gap
    The classification of business logic flaws has been under-studied, although exploitation of business flaws frequently
    happens in real-world systems, and many applied vulnerability researchers investigate them. The greatest focus is in
    web applications. There is debate within the community about whether these problems represent particularly new
    concepts, or if they are variations of well-known principles.
    Many business logic flaws appear to be oriented toward business processes, application flows, and sequences of
    behaviors, which are not as well-represented in CWE as weaknesses related to input validation, memory management,
    etc.
    References

    [REF-795] Jeremiah Grossman. "Business Logic Flaws and Yahoo Games". 2006-12-08.
    <https://blog.jeremiahgrossman.com/2006/12/business-logic-flaws.html>. URL validated: 2023-04-07.
    [REF-796] Jeremiah Grossman. "Seven Business Logic Flaws That Put Your Website At Risk". 2007-10.
    <https://docplayer.net/10021793-Seven-business-logic-flaws-that-put-your-website-at-risk.html>. URL validated: 2023-04-
    07.

    [REF-797] WhiteHat Security. "Business Logic Flaws".


    <https://web.archive.org/web/20080720171327/http://www.whitehatsec.com/home/solutions/BL_auction.html>. URL
    validated: 2023-04-07.

    [REF-798] WASC. "Abuse of Functionality". <http://projects.webappsec.org/w/page/13246913/Abuse-of-Functionality>.


    [REF-799] Rafal Los and Prajakta Jagdale. "Defying Logic: Theory, Design, and Implementation of Complex Systems for
    Testing Application Logic". 2011. <https://www.slideshare.net/RafalLos/defying-logic-business-logic-testing-with-
    automation>. URL validated: 2023-04-07.
    [REF-667] Rafal Los. "Real-Life Example of a 'Business Logic Defect' (Screen Shots!)". 2011.
    <http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-Example-of-a-Business-Logic-Defect-Screen-
    Shots/ba-p/22581>.
    [REF-801] Viktoria Felmetsger, Ludovico Cavedon, Christopher Kruegel and Giovanni Vigna. "Toward Automated Detection
    of Logic Vulnerabilities in Web Applications". USENIX Security Symposium 2010. 2010-08.
    <https://www.usenix.org/legacy/events/sec10/tech/full_papers/Felmetsger.pdf>. URL validated: 2023-04-07.
    [REF-802] Faisal Nabi. "Designing a Framework Method for Secure Business Application Logic Integrity in e-Commerce
    Systems". pages 29 - 41. International Journal of Network Security, Vol.12, No.1. 2011.
    <http://ijns.femto.com.tw/contents/ijns-v12-n1/ijns-2011-v12-n1-p29-41.pdf>.
    [REF-1102] Chetan Conikee. "Case Files from 20 Years of Business Logic Flaws". 2020-02. <https://published-
    prd.lanyonevents.com/published/rsaus20/sessionsFiles/18217/2020_USA20_DSO-
    R02_01_Case%20Files%20from%2020%20Years%20of%20Business%20Logic%20Flaws.pdf>.
    Content History

    Submissions
    Submission Date Submitter Organization
    2011-03-24 CWE Content Team MITRE
    (CWE 1.12, 2011-03-30)
    Modifications

    You might also like