CWE-507 is a product that appears to contain benign or useful functionality, but also contains code hidden from normal operation that violates the security policy of the user or administrator. The useful part is the cover story.
How it happens
The hidden code ships inside something people want to install. That might be a tool, a plugin or a package that does what it says while also doing something else. Because the visible function works, nobody has a reason to look harder.
For development teams the practical entry point is the supply chain: a dependency, a build tool or an installer you did not write.
What an attacker gains
MITRE lists the ability to execute unauthorized code or commands, with impact on confidentiality, integrity and availability. Whatever rights the user or host has, the hidden code can use.
How to find it
The MITRE record lists no detection methods for this entry. Simple checks still help: compare what a package declares with what it does, review new dependencies before adding them, and watch for unexpected network calls at install or run time.
How to fix it
MITRE's mitigations are short.
- At installation, verify the integrity of the product being installed, for example against a published checksum or signature.
- In operation, run antivirus software, which scans for Trojan horses.
Add a dependency scan to your pipeline so new packages are checked before they land. The free in-browser scan takes a manifest with up to 100 dependencies, needs no login, and the file stays on your machine.
Quick check
What makes a Trojan horse different from a plain bug?
The harmful behavior is deliberate and hidden inside functionality that looks legitimate.
