CWE-623, Unsafe ActiveX Control Marked Safe For Scripting, is the sibling of CWE-618. The control was meant for restricted use, but its author flagged it as safe for scripting, so a web page can call it without a prompt.
How it happens
The safe-for-scripting flag is a statement to the browser that the control cannot do harm when driven by untrusted script. For a control with powerful behavior, the statement is false. The browser then lets any page instantiate and use it.
MITRE's examples show the range. One control let attackers add malicious email addresses to bypass spam limits. In another case a kiosk allowed a bypass to read files (CVE-2006-6510). A web browser also used certain COM objects as ActiveX.
What an attacker gains
The record lists confidentiality, integrity and availability, through execution of unauthorized code or commands. The exact outcome depends on what the control does.
How to find it
The record lists no detection methods. Audit the registered controls in your product and check which carry the safe-for-scripting flag, then ask what the worst call a hostile page could make is.
How to fix it
- During development, do not mark the control as safe for scripting.
- After distribution, set the kill bit for the control so that it is not accessible from Internet Explorer.
Quick check
What does setting the kill bit do?
It stops the control from being accessible from Internet Explorer, which is MITRE's fix for controls already shipped.
