CWE-623 (不安全的ActiveX控件被标记为脚本安全) — Vulnerability Class 3

CWE-623 represents a critical configuration weakness where an ActiveX control, originally designed for restricted environments, is incorrectly flagged as safe-for-scripting. This misconfiguration allows malicious web pages to instantiate and execute the control’s functionality without triggering security warnings or requiring explicit user consent. Attackers typically exploit this by embedding the vulnerable control within a compromised website, enabling remote code execution, data exfiltration, or system compromise through the control’s privileged operations. To prevent this vulnerability, developers must rigorously audit component configurations, ensuring that only controls with verified, low-risk behaviors are marked as safe-for-scripting. Furthermore, implementing strict content security policies and disabling unnecessary ActiveX support in browsers can mitigate the attack surface, ensuring that potentially dangerous components remain isolated from untrusted web contexts.