Full Report
Organizational culture and systemic gaps in Secure by Design adoption blamed for sorry state of affairs
Analysis Summary
# Vulnerability: Persistent "Stubborn" and "Unforgivable" Weakness Classes (2024-2025)
## CVE Details
*Note: This report focuses on systemic weakness classes rather than a single CVE ID, as the CISA review highlights high-frequency trends across the KEV catalog.*
- **CVE ID:** Multiple (Covers a significant portion of the CISA Known Exploited Vulnerabilities catalog)
- **CVSS Score:** Variable (Typically 7.0 - 10.0 range for these classes)
- **CWE:**
- **CWE-20:** Improper Input Validation (Most common weakness)
- **CWE-22:** Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- **CWE-78:** Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- **CWE-79:** Cross-site Scripting (XSS)
- **CWE-89:** SQL Injection
## Affected Systems
- **Products:** Wide-scale impact across diverse software vendors (Network appliances, web applications, and enterprise software).
- **Versions:** Multiple legacy and modern versions.
- **Configurations:** Systems lacking "Secure by Design" (SBD) principles; products with inadequate input sanitization and default configurations that permit command execution.
## Vulnerability Description
CISA identifies a systemic failure in the software industry to eradicate "unforgivable" vulnerabilities—flaws resulting from well-documented, common mistakes with obvious attack paths. These include injection-related flaws and improper input validation. Despite being identified as critical threats as early as 2007, these weaknesses persist because of organizational culture and developer workflows rather than technical complexity.
## Exploitation
- **Status:** **Exploited in the wild** (Represents 41.5% of all entries in the CISA KEV catalog).
- **Complexity:** **Low** (Exploits are often simple and "obvious").
- **Attack Vector:** Primarily **Network**.
## Impact
- **Confidentiality:** **High** (Data theft via SQLi and Path Traversal).
- **Integrity:** **High** (System compromise via OS Command Injection).
- **Availability:** **High** (System takeover or disruption).
## Remediation
### Patches
- **Vendor-Specific:** Users must apply the latest security patches from individual software vendors immediately, as these flaws are actively targeted.
- **Strategic:** CISA recommends vendors adopt **Secure by Design (SBD)** practices to eliminate these vulnerability classes at the source code level during development.
### Workarounds
- Implement robust **Input Validation** and output encoding.
- Enforce the **Principle of Least Privilege** for service accounts to limit the impact of injection attacks.
- Deploy Web Application Firewalls (WAF) to filter common injection patterns.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic, unauthorized file access attempts (Path Traversal), and unexpected system command executions.
- **Detection methods and tools:**
- Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST).
- Regular scanning against the CISA KEV catalog.
- Log analysis for suspicious characters in URI parameters (e.g., `../`, `;`, `|`).
## References
- CISA Known Exploited Vulnerabilities Catalog: [https]://www.cisa.gov/known-exploited-vulnerabilities-catalog
- MITRE Unforgivable Vulnerabilities (2007): [https]://cwe.mitre.org/documents/unforgivable_vulns/unforgivable.pdf
- MITRE Stubborn Weaknesses (2023): [https]://cwe.mitre.org/top25/archive/2023/2023_stubborn_weaknesses.html