CWE•Class•Draft•1 recent CVE
CWE-642External Control of Critical State Data
Description
The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
[object Object]
Common consequences
- Access Control→Bypass Protection Mechanism,Gain Privileges or Assume IdentityAn attacker could potentially modify the state in malicious ways. If the state is related to the privileges or level of authentication that the user has, then state modification might allow the user to bypass authentication or elevate privi
- Confidentiality→Read Application DataThe state variables may contain sensitive information that should not be known by the client.
- Availability→DoS: Crash, Exit, or RestartBy modifying state variables, the attacker could violate the application's expectations for the contents of the state, leading to a denial of service due to an unexpected error condition.
Potential mitigations
- Architecture and DesignUnderstand all the potential locations that are accessible to attackers. For example, some programmers assume that cookies and hidden form fields cannot be modified by an attacker, or they may not consider that environment variables can be modified before a privileged program is invoked.
- Architecture and Design[object Object]
- Architecture and DesignStore state information on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions.
- Architecture and Design[object Object]
- Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Operation,ImplementationWhen using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.