1084
Potential Mitigations
Phase: System Configuration
Disable or change default settings when they can be used to abuse the system. Since those
default settings are shipped with the product they are likely to be known by a potential attacker
who is familiar with the product. For instance, default credentials should be changed or the
associated accounts should be disabled.
Demonstrative Examples
Example 1:
This code attempts to login a user using credentials from a POST request:
Example Language: PHP (Bad)
// $user and $pass automatically set from POST request
if (login_user($user,$pass)) {
$authorized = true;
}
...
if ($authorized) {
generatePage();
}
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any
value included in the POST request if register_globals is enabled. An attacker can send a POST
request with an unexpected third value 'authorized' set to 'true' and gain authorized status without
supplying valid credentials.
Here is a fixed version:
Example Language: PHP (Good)
$user = $_POST['user'];
$pass = $_POST['pass'];
$authorized = false;
if (login_user($user,$pass)) {
$authorized = true;
}
...
This code avoids the issue by initializing the $authorized variable to false and explicitly retrieving
the login credentials from the $_POST variable. Regardless, register_globals should never be
enabled and is disabled by default in current versions of PHP.
Observed Examples
Reference Description
CVE-2022-36349 insecure default variable initialization in BIOS firmware for a hardware board
allows DoS
https://www.cve.org/CVERecord?id=CVE-2022-36349
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 966 SFP Secondary Cluster: Other Exposures 888 2403
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
CWE Version 4.14
CWE-454: External Initialization of Trusted Variables or Data Stores
CWE-454: External Initialization of Trusted Variables or Data Stores