Weakness · High
CWE-627: Dynamic Variable Evaluation
What it is
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
The resultant vulnerabilities depend on the behavior of the application, both at the crossover point and in any control/data flow that is reachable by the related variables or functions.
What an attacker can do
- Modify Application Data (Confidentiality, Integrity, Availability)
- Execute Unauthorized Code or Commands (Confidentiality, Integrity, Availability)
How to prevent it
Implementation
- Refactor the code to avoid dynamic variable evaluation whenever possible.
- Use only allowlists of acceptable variable or function names.
- For function names, ensure that you are only calling functions that accept the proper number of arguments, to avoid unexpected null arguments.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.