Weakness · High
CWE-914: Improper Control of Dynamically-Identified Variables
What it is
The product does not properly restrict reading from or writing to dynamically-identified variables.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.
What an attacker can do
- Modify Application Data (Integrity)
- Execute Unauthorized Code or Commands (Integrity)
- Varies by Context (Other, Integrity)
- Alter Execution Logic (Other, Integrity)
How to prevent it
Implementation
- For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
- Refactor the code so that internal program variables do not need to be dynamically identified.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.