CWE-1054 describes code at one architectural layer that calls code in a deeper layer than the one next to it. The call skips at least one layer, and the target is not a shared utility layer meant to be used from anywhere. Teams with layered designs, such as controller, service and data access, run into this most often.
How it happens
A layered design says the web layer talks to the service layer, and the service layer talks to the data layer. Under pressure, a controller reaches straight into the database helper because it is faster than adding a service method. It works, so it stays.
One bypass is rarely a problem. Twenty of them mean the layers no longer describe how the system behaves.
A sketch in Python of the pattern:
# Vulnerable pattern: the web layer reaches past the service layer
def get_invoice(request, invoice_id):
return db.query("SELECT * FROM invoices WHERE id = %s", invoice_id)
# Better: go through the layer that owns the rules
def get_invoice(request, invoice_id):
return invoice_service.get_for_user(request.user, invoice_id)
In the first version, any check the service layer would have applied, such as ownership, is skipped. This is an illustration of the shape of the problem, not a specific flaw from the MITRE record.
What an attacker gains
MITRE lists reduced maintainability. The code is harder to understand, which "indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities." It also "might make it easier to introduce vulnerabilities."
How to find it
The record lists no detection methods. In practice you can review import graphs: if a module in the top layer imports from the bottom layer, flag it. Many languages have tools that enforce dependency rules between packages.
How to fix it
The record has no mitigations, so these are general steps.
- Write down which layers may call which.
- Route the skipping call through the adjacent layer, adding a method there if needed.
- Enforce the rule in a build check so it does not drift back.
Quick check
Is a call to a shared utility layer also a violation?
No. The definition excludes a vertical utility layer that can be referenced from any horizontal layer.
