# Vulnerability Classes

Common vulnerability classes mapped to OWASP categories, CWE families, and practical review guidance.

## OWASP/CWE Mapping Table

| Category | CWE families | High-risk code locations | Review focus |
|---|---|---|---|
| Injection | CWE-89, CWE-78, CWE-94, CWE-917 | Query builders, search filters, command helpers, template engines | Parameterization, strict allowlists, no dynamic eval/command construction |
| Broken access control / IDOR | CWE-284, CWE-285, CWE-639 | Object fetch by ID, multi-tenant filters, admin routes | Object-level authorization, tenant scoping everywhere |
| Authn/session weaknesses | CWE-287, CWE-384, CWE-613 | Login flows, token minting, session cookies, password reset | MFA support, secure cookies, rotation, replay resistance |
| Cryptographic failures | CWE-327, CWE-326, CWE-321 | Token signing, encryption at rest, password hashing | Approved primitives, correct key handling, strong hashing |
| SSRF / unsafe URL fetch | CWE-918 | Webhook fetchers, URL preview, doc importers, MCP URL-fetch tools | Egress allowlists, DNS/IP checks, block metadata/rfc1918, timeouts |
| XSS / output encoding | CWE-79 | Templates, markdown renderers, admin consoles | Contextual encoding, safe templating defaults, sanitize rich content |
| Deserialization / parsing | CWE-502 | Message consumers, import endpoints, cache deserialization | Safe parsers, forbid dangerous types, strict schemas |
| Security misconfiguration | CWE-16, CWE-611 (XXE) | Default configs, debug endpoints, CORS/CSP/TLS settings | Secure defaults, remove debug, harden parsers |
| Sensitive data exposure | CWE-200, CWE-532 | Error handlers, logs, analytics, debug dumps | Redaction, structured logging, no secrets in logs |

## Web Application Vulnerability Classes

### Injection (SQL, NoSQL, LDAP, OS command, template)

**What to look for:**

- String concatenation in queries or commands
- User input in `eval()`, `exec()`, template literals, or shell commands
- Dynamic query construction without parameterization

**Fix pattern:** Parameterized queries, prepared statements, strict allowlists for command arguments.

### Cross-Site Scripting (XSS)

**What to look for:**

- User input rendered in HTML without encoding
- `innerHTML`, `dangerouslySetInnerHTML`, or equivalent
- Markdown/rich text rendering without sanitization

**Fix pattern:** Contextual output encoding (HTML/JS/URL/CSS), Content Security Policy, sanitization libraries.

### Broken Authentication and Session Management

**What to look for:**

- Weak password policies, missing MFA
- Session tokens in URLs, missing Secure/HttpOnly/SameSite flags
- No token expiry or rotation; session fixation
- Password reset flows without rate limiting or token expiry

**Fix pattern:** Strong session management library, secure cookie flags, short-lived tokens, MFA.

### Broken Access Control

**What to look for:**

- Missing authorization checks on direct object references
- Client-side only authorization enforcement
- Missing tenant scoping in database queries
- Admin functions accessible without role verification

**Fix pattern:** Server-side object-level authorization on every access, tenant ID in every query, role checks in middleware.

### SSRF and Unsafe URL Fetching

**What to look for:**

- User-controlled URLs passed to HTTP clients
- No validation of destination IP ranges (metadata services, internal networks)
- Following redirects without validation
- Missing timeouts and response size limits

**Fix pattern:** URL allowlists, block private IP ranges (10.x, 172.16-31.x, 169.254.x, 127.x), DNS pinning, timeouts.

### CSRF, Clickjacking, CORS Misconfiguration

**What to look for:**

- State-changing operations without CSRF tokens
- Missing `X-Frame-Options` or CSP `frame-ancestors`
- `Access-Control-Allow-Origin: *` on authenticated endpoints

**Fix pattern:** Anti-CSRF tokens, SameSite cookies, restrictive CORS origins, frame-ancestors directive.

### Insecure Deserialization

**What to look for:**

- Deserialization of untrusted data (pickle, Java serialization, YAML unsafe load)
- No type restrictions or schema validation
- Deserialization in message consumers or import endpoints

**Fix pattern:** Safe parsers (JSON over binary formats), forbid dangerous types, schema validation before deserialization.

### Path Traversal and File System Access

**What to look for:**

- User input in file paths (`../`, URL-encoded variants)
- Missing canonicalization of paths
- File uploads stored with user-controlled names

**Fix pattern:** Canonicalize paths, validate against base directory, use random filenames for uploads.

## Agentic / MCP-Specific Vulnerability Classes

### Prompt Injection / Indirect Prompt Injection

**What to look for:**

- User input or retrieved content that can influence tool selection
- Model-generated tool arguments derived from untrusted data
- Missing validation between "user intent" and "tool invocation"

**Fix pattern:** Tool argument validation, allowlists for tool use by role, human approval for sensitive actions, treat retrieved content as untrusted.

### Authorization Confusion

**What to look for:**

- Model or server treating "what the user asked for" as "what the user is authorized to do"
- Shared service credentials used for all tool calls
- Missing per-user identity propagation in MCP tool execution

**Fix pattern:** Server-side per-tool authorization, user identity propagation, tenant isolation, explicit scope checks.

## Common Mistakes

- Blocklists instead of allowlists for input validation
- Authorization only at the UI layer (not enforced server-side)
- Trusting "internal" service traffic without validation
- Error messages that reveal stack traces or internal paths
- Secrets committed to source control (even if later rotated)
- Rate limiting only on the frontend
