CWE-454: External Initialization of Trusted Variables or Data Stores
External Initialization of Trusted Variables or Data Stores
Weakness ID: 454 (Weakness Base)
Status: Draft
Description
Description Summary
The software initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
Extended Description
A software system should be reluctant to trust variables that have been initialized outside of its trust boundary, especially if they are initialized by users. They may have been initialized incorrectly. If an attacker can initialize the variable, then he/she can influence what the vulnerable system will do.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
PHP: (Sometimes)
Language-independent
Platform Notes
This is often found in PHP due to register_globals and the common practice
of storing library/include files under the web document root so that they
are available using a direct request.
Common Consequences
Scope
Effect
Integrity
Technical Impact: Modify application
data
Demonstrative Examples
Example 1
In the Java example below, a system property controls the debug
level of the application.
(Bad Code)
Example
Language: Java
int debugLevel =
Integer.getInteger("com.domain.application.debugLevel").intValue();
If an attacker is able to modify the system property, then it may be
possible to coax the application into divulging sensitive information by
virtue of the fact that additional debug information is printed/exposed
as the debug level increases.
Example 2
This code checks the HTTP POST request for a debug switch, and
enables a debug mode if the switch is set.
(Bad Code)
Example
Language: PHP
$debugEnabled = false;
if ($_POST["debug"] == "true"){
$debugEnabled = true;
}
/.../
function login($username, $password){
if($debugEnabled){
echo 'Debug Activated';
phpinfo();
$isAdmin = True;
return True;
}
}
Any user can activate the debug mode, gaining administrator
privileges. An attacker may also use the information printed by the
phpinfo() function to further exploit the system. .
This example also exhibits Information Exposure Through Debug Information (CWE-215)
Specify arbitrary modules using environment
variable.
Potential Mitigations
A software system should be reluctant to trust variables that have
been initialized outside of its trust boundary. Ensure adequate checking
(e.g. input validation) is performed when relying on input from outside
a trust boundary.
Phase: Architecture and Design
Avoid any external control of variables. If necessary, restrict the
variables that can be modified using a whitelist, and use a different
namespace or naming convention if possible.
Description
