Book a Security Review

Weakness · High

CWE-913: Improper Control of Dynamically-Managed Code Resources

What it is

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

1 exploited in the wildMITRE CWE 4.19.1

Severity (our rating)
High
Likelihood of exploit
Not rated by MITRE
Introduced during
Architecture and Design, Implementation
Exploited in the wild
1 known exploited CVE

In more detail

Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.

What an attacker can do

  • Execute Unauthorized Code or Commands (Integrity)
  • Varies by Context (Other, Integrity)
  • Alter Execution Logic (Other, Integrity)

How to prevent it

Implementation

  • For any externally-influenced input, check the input against an allowlist of acceptable values.
  • Refactor the code so that it does not need to be dynamically managed.

How to find it

  • Fuzzing. Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

CWE-913 on MITRE's CWE site

Exploited in the wild: 1 CVE

Vulnerabilities caused by CWE-913 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.

All known exploited vulnerabilities

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.