CWE-506 Embedded Malicious Code

The product contains code that appears to be malicious in nature.

• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands

• [Implementation, Operation] Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

• Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies • Generated Code Inspection • Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Automated Monitored Execution • Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Manual Source Code Review (not inspections) • Automated Static Analysis: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Origin Analysis

• CVE-2022-30877: A command history tool was shipped with a code-execution backdoor inserted by a malicious party.