CWE-695: Use of Low-Level Functionality
The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.
Last updated
Overview
The use of low-level functionality can violate the specification in unexpected ways that effectively disable built-in protection mechanisms, introduce exploitable inconsistencies, or otherwise expose the functionality to attack.
Common consequences
What can happen when CWE-695 is exploited.
Other
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following code defines a class named Echo. The class declares one native method (defined below), which uses C to echo commands entered on the console back to the user. The following C code defines the native method implemented in the Echo class:
Vulnerable example
class Echo {Vulnerable example
#include <jni.h>The following example opens a socket to connect to a remote server.
Vulnerable example
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {A Socket object is created directly within the Java servlet, which is a dangerous way to manage remote connections.
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-695.
- What is CWE-695?
- The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.
- How is CWE-695 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-695?
- Exploiting CWE-695 can lead to: Other.
References
- MITRE CWE definition (CWE-695) (opens in a new tab)
- CWE-695 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-695
Get alerted the moment a new CWE-695 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.