CWEweakness

CWE-623 Unsafe ActiveX Control Marked Safe For Scripting

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product includes an ActiveX control that is intended for restricted use, but the control has been marked as safe-for-scripting.

Common consequences

• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands — Attackers may be able to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Potential mitigations

• [Architecture and Design] During development, do not mark it as safe for scripting. • [System Configuration] After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

Observed examples

• CVE-2007-0617: control allows attackers to add malicious email addresses to bypass spam limits • CVE-2007-0219: web browser uses certain COM objects as ActiveX • CVE-2006-6510: kiosk allows bypass to read files

Related

Observed example · CVE (3)

  • CVE-2007-0219 Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX… vulnerability
  • CVE-2007-0617 The SpamBlocker.dll ActiveX control in Earthlink TotalAccess is marked "safe for scripting," which allows remote attackers to add arbitrary… vulnerability
  • CVE-2006-6510 An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security… vulnerability

Child of · CWE (1)

  • CWE-267 Privilege Defined With Unsafe Actions weakness

Peer of · CWE (1)

  • CWE-618 Exposed Unsafe ActiveX Method weakness

Referenced by CVE · weakness (3)

  • CVE-2011-10028 The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via… vulnerability
  • CVE-2018-17925 Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX… vulnerability
  • CVE-2014-2368 The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files… vulnerability