Read Time:3 Minute, 42 Second
Description
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: High
Related Weaknesses
CWE-668
Consequences
Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity
An attacker could potentially modify the state in malicious ways. If the state is related to the privileges or level of authentication that the user has, then state modification might allow the user to bypass authentication or elevate privileges.
Confidentiality: Read Application Data
The state variables may contain sensitive information that should not be known by the client.
Availability: DoS: Crash, Exit, or Restart
By modifying state variables, the attacker could violate the application’s expectations for the contents of the state, leading to a denial of service due to an unexpected error condition.
Potential Mitigations
Phase: Architecture and Design
Description:
Understand all the potential locations that are accessible to attackers. For example, some programmers assume that cookies and hidden form fields cannot be modified by an attacker, or they may not consider that environment variables can be modified before a privileged program is invoked.
Phase: Architecture and Design
Description:
Phase: Architecture and Design
Description:
Store state information on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions.
Phase: Architecture and Design
Description:
Phase: Architecture and Design
Description:
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Phase: Operation, Implementation
Description:
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
Phase: Testing
Description:
Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible.
Phase: Testing
Description:
Use dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software’s operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Phase: Testing
Description:
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
CVE References
- CVE-2005-2428
- Mail client stores password hashes for unrelated accounts in a hidden form field.
- CVE-2008-0306
- Privileged program trusts user-specified environment variable to modify critical configuration settings.
- CVE-1999-0073
- Telnet daemon allows remote clients to specify critical environment variables for the server, leading to code execution.
- CVE-2007-4432
- Untrusted search path vulnerability through modified LD_LIBRARY_PATH environment variable.
- CVE-2006-7191
- Untrusted search path vulnerability through modified LD_LIBRARY_PATH environment variable.
- CVE-2008-5738
- Calendar application allows bypass of authentication by setting a certain cookie value to 1.
- CVE-2008-5642
- Setting of a language preference in a cookie enables path traversal attack.
- CVE-2008-5125
- Application allows admin privileges by setting a cookie value to “admin.”
- CVE-2008-5065
- Application allows admin privileges by setting a cookie value to “admin.”
- CVE-2008-4752
- Application allows admin privileges by setting a cookie value to “admin.”
- CVE-2000-0102
- Shopping cart allows price modification via hidden form field.
- CVE-2000-0253
- Shopping cart allows price modification via hidden form field.
- CVE-2008-1319
- Server allows client to specify the search path, which can be modified to point to a program that the client has uploaded.
