quick question: if a security bug has a low likelihood of occuring, has low impact, but high severity if it is able to be executed, is it still a security vulnerability? to be more specific, exploiting it is almost impossible: so, is it worth the resource in fixing it?
let me explain in detail so that you all get a gist of what i'm trying to point out here. but first of all, let's just acknowledged the fact that i've developed software before, and that i am very familiar with software development methodology and lifecycle. and yes, i do know the thought process of a programmer without any security trainings or secure coding education because i've been one before.
the bug that i found has a low likelihood of being exploited. in fact, the probability that an attacker can exploit it almost 0. since this has been proven, it is safe to say that the finding has no effect on security. in fact, the finding should not be in the final report to the client.
the bug exist in a variable that is automatically generated by the asp.net framework, much like php's $_POST, $_REQUEST or $_GET global variables, but not quite. this variable contains values that are pertinent to the requested page - i.e. the back-end application will take it, process it and display them in a nice html page. the values are initially retrieved from database or soap servers. this variable, and its values are never re-inserted in the database or sent back to the soap servers - they are non-persistent.
so, as an attacker, even if i manipulate the values of the magic asp.net variable there is nothing much that i can do. this has been the basis of arguments between me and the vendor - they refuse to adopt one of the best practices in secure coding - "filter inputs that are sent to and from the application" simply because the values are non persistent. fine.
wearing my programmer hat (a fresh graduate without exposure to secure coding practices), i know a gazillion ways how this magic variable can be abused. assuming i have another script that processes the same information - i don't have to repeatedly retrieve the values from the database.i just have to use that magic variable! save a few lines of codes and i can play world of warcraft later. even worse: what if the database needs updating? fine i just put them back into the database!
so, you are right in saying that no fixing needs to be done, but you're wrong in assuming that. programmers are lazy, and the lazy ones produce insecure codes. your application is complex, and complex application contains complex codes, and complex codes are insecure.
