Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-459 Base Borrador
Incomplete Cleanup
This vulnerability occurs when an application fails to properly remove temporary files, data structures, or system resources after they are no longer needed.
Definición
What is CWE-459?
This vulnerability occurs when an application fails to properly remove temporary files, data structures, or system resources after they are no longer needed.
Incomplete cleanup happens when developers focus on the primary function of their code but neglect the final 'housekeeping' steps. This often involves forgetting to close file handles, database connections, or network sockets, or leaving temporary files in shared directories. These leftover resources can accumulate over time, leading to performance degradation, data leaks, or denial of service as system limits are reached.
From a security perspective, uncleaned temporary files can expose sensitive data to other users or processes on the system. In multi-user environments, this can allow unauthorized access to session tokens, configuration secrets, or user data. The risk is particularly high when predictable filenames are used, as attackers can easily locate and exploit these residual artifacts.
Impacto en el mundo real
Real-world CVEs caused by CWE-459
-
World-readable temporary file not deleted after use.
-
Temporary file not deleted after use, leaking database usernames and passwords.
-
Interaction error creates a temporary file that can not be deleted due to strong permissions.
-
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
-
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
-
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
-
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
-
Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
Identifica una ruta de código que maneje entrada no confiable sin validación.
- 2
Crea un payload que ejercite el comportamiento inseguro — inyección, traversal, overflow o abuso de lógica.
- 3
Envía el payload a través de una solicitud normal y observa la reacción de la aplicación.
- 4
Itera hasta que la respuesta filtre datos, ejecute código del atacante o escale privilegios.
Ejemplo de código vulnerable
Vulnerable Java
Stream resources in a Java application should be released in a finally block, otherwise an exception thrown before the call to close() would result in an unreleased I/O resource. In the example below, the close() method is called in the try block (incorrect).
try {
InputStream is = new FileInputStream(path);
byte b[] = new byte[is.available()];
is.read(b);
is.close();
} catch (Throwable t) {
log.error("Something bad happened: " + t.getMessage());
} Ejemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-459
- Architecture and Design / Implementation Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Señales de detección
How to detect CWE-459
CWE-459
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Preguntas frecuentes ¿Qué es CWE-459?
¿Qué gravedad tiene CWE-459?
¿Qué lenguajes o plataformas se ven afectados por CWE-459?
¿Cómo puedo prevenir CWE-459?
¿Cómo detecta y corrige Plexicus CWE-459?
¿Dónde puedo aprender más sobre CWE-459?
Frequently asked questions
¿Qué es CWE-459?
This vulnerability occurs when an application fails to properly remove temporary files, data structures, or system resources after they are no longer needed.
¿Qué gravedad tiene CWE-459?
MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.
¿Qué lenguajes o plataformas se ven afectados por CWE-459?
MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.
¿Cómo puedo prevenir CWE-459?
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
¿Cómo detecta y corrige Plexicus CWE-459?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-459 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-459?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/459.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-459
CWE-404 Padre
Improper Resource Shutdown or Release
This vulnerability occurs when a program fails to properly close or release a system resource—like a file handle, database connection, or…
CWE-1266 Hermano
Improper Scrubbing of Sensitive Data from Decommissioned Device
This vulnerability occurs when a system lacks a reliable method for administrators to permanently erase sensitive information before…
CWE-299 Hermano
Improper Check for Certificate Revocation
This vulnerability occurs when an application fails to properly verify whether a security certificate has been revoked, potentially…
CWE-401 Hermano
Missing Release of Memory after Effective Lifetime
This vulnerability occurs when a program allocates memory but fails to properly release it after it's no longer needed, causing a gradual…
CWE-761 Hermano
Free of Pointer not at Start of Buffer
This vulnerability occurs when a program incorrectly frees a memory pointer that no longer points to the beginning of the allocated heap…
CWE-762 Hermano
Mismatched Memory Management Routines
This vulnerability occurs when a program uses incompatible functions to allocate and free memory. For example, freeing memory with a…
CWE-763 Hermano
Release of Invalid Pointer or Reference
This vulnerability occurs when a program tries to free a memory resource back to the system but uses an incorrect deallocation method or…
CWE-772 Hermano
Missing Release of Resource after Effective Lifetime
This vulnerability occurs when a program fails to properly release a system resource—like memory, file handles, or network sockets—after…
CWE-775 Hermano
Missing Release of File Descriptor or Handle after Effective Lifetime
This vulnerability occurs when a program fails to properly close file descriptors or handles after they are no longer needed, leaving…
¿Listo para validar lo que importa?
Listo para validar lo que importa.
Plexicus es Proof-Driven AppSec: hallazgos validados, comprensión contextual y remediación revisada — anclada en evidencia, acotada contigo.