CWE-1177: Use of Prohibited Code

What is Use of Prohibited Code?

• Overview: Use of Prohibited Code (CWE-1177) occurs when a product uses a function, library, or third-party component that has been explicitly banned by the developer or customer, often due to security concerns, licensing issues, or maintenance problems.

• Exploitation Methods:

• Attackers can exploit known vulnerabilities in prohibited code if it is used within a product.
• Common attack patterns include leveraging deprecated or insecure functions to gain unauthorized access or execute malicious code.

• Security Impact:

• Direct consequences of successful exploitation can include unauthorized access, data breaches, or system compromise.
• Potential cascading effects involve broader security vulnerabilities in interconnected systems and components.
• Business impact may include increased maintenance costs, legal liabilities, and damage to reputation.

• Prevention Guidelines:

• Specific code-level fixes include replacing prohibited functions with secure alternatives and refactoring code to remove dependencies on banned components.
• Security best practices involve regularly updating and reviewing lists of prohibited code and auditing codebases for compliance.
• Recommended tools and frameworks include static code analysis tools and dependency management systems to identify and flag prohibited code usage.

Corgea can automatically detect and fix Use of Prohibited Code in your codebase. Try Corgea free today.

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not specified

Affected Technologies: Not specified