1415
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
An attacker could potentially modify the state in malicious
ways. If the state is related to the privileges or level of
authentication that the user has, then state modification
might allow the user to bypass authentication or elevate
privileges.
Confidentiality Read Application Data
The state variables may contain sensitive information that
should not be known by the client.
Availability DoS: Crash, Exit, or Restart
By modifying state variables, the attacker could violate
the application's expectations for the contents of the state,
leading to a denial of service due to an unexpected error
condition.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Understand all the potential locations that are accessible to attackers. For example, some
programmers assume that cookies and hidden form fields cannot be modified by an attacker, or
they may not consider that environment variables can be modified before a privileged program is
invoked.
Phase: Architecture and Design
Strategy = Attack Surface Reduction
Store state information and sensitive data on the server side only. Ensure that the system
definitively and unambiguously keeps track of its own state and user state and has rules defined
for legitimate state transitions. Do not allow any application user to affect state directly in any
way other than through legitimate actions leading to state transitions. If information must be
stored on the client, do not do so without encryption and integrity checking, or otherwise having
a mechanism on the server side to catch tampering. Use a message authentication code (MAC)
algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against
the state or sensitive data that has to be exposed, which can guarantee the integrity of the data -
i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
Phase: Architecture and Design
Store state information on the server side only. Ensure that the system definitively and
unambiguously keeps track of its own state and user state and has rules defined for legitimate
state transitions. Do not allow any application user to affect state directly in any way other than
through legitimate actions leading to state transitions.
Phase: Architecture and Design
CWE Version 4.14
CWE-642: External Control of Critical State Data
CWE-642: External Control of Critical State Data