Inappropriate coding practices - Transparency Conflict
Description
The application uses Transparency attributes such as SecurityCriticalAttribute and SecuritySafeCriticalAttribute to identify code that performs critical security operations. However a transparency conflict is created when a member is marked with a security attribute that has a different transparency than the security attribute of a container of the member.
Impact
Cause unexpected behaviors in the application.
Recommendation
Remove nested transparency annotation to avoid security attributes conflicts.
Threat
Anonymous attacker from Internet.
Expected Remediation Time
⌚ 30 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: N
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: L
- Availability: N
Temporal
- Exploit code maturity: U
- Remediation level: U
- Report confidence: R
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:R
- Score:
- Base: 3.7
- Temporal: 3.3
- Severity:
- Base: Low
- Temporal: Low
Score 4.0
Default score using CVSS 4.0 . It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: U
Result 4.0
- Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
- Score:
- CVSS-BT: 1.7
- Severity:
- CVSS-BT: Low
Compliant code
The source code does not have any transparency annotations in production
using System;
using System.Security;
namespace MyLibrary{
public class Foo{
public void Bar(){
//Do something
}
public void Testeo(){
//Do something
}
}
}
Non compliant code
There are nested transparency annotations in the source code
using System;
using System.Security;
namespace MyLibrary{
[SecurityCritical]
public class Foo{
[SecuritySafeCritical]
public void Bar(){
//Do something
}
public void Testeo(){
//Do something
}
}
}
Details
https://rules.sonarsource.com/csharp/type/Vulnerability/RSPEC-4211
Requirements
Fixes
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.