2091
}
}
The expected order of operations is a call to Request::setup(), followed by a call to
Request::send(). Request::send() calls scriptEngine->coerceToString(_data) to coerce a scriptprovided
parameter into a string. This operation may produce script execution. For example, if
the script language is ECMAScript, arbitrary script execution may result if _data is an adversarysupplied
ECMAScript object having a custom toString method. If the adversary's script makes a
new call to Request::setup, then when control returns to Request::send, the field uri and the local
variable credentials will no longer be consistent with one another. As a result, credentials for one
resource will be shared improperly with a different resource. The root of this weakness is that while
one operation on Request (send) is in the midst of executing, a second operation may be invoked
(setup).
Observed Examples
Reference Description
CVE-2014-1772 In this vulnerability, by registering a malicious onerror handler, an adversary
can produce unexpected re-entrance of a CDOMRange object. [REF-1098]
https://www.cve.org/CVERecord?id=CVE-2014-1772
CVE-2018-8174 This CVE covers several vulnerable scenarios enabled by abuse of
the Class_Terminate feature in Microsoft VBScript. In one scenario,
Class_Terminate is used to produce an undesirable re-entrance of
ScriptingDictionary during execution of that object's destructor. In another
scenario, a vulnerable condition results from a recursive entrance of a property
setter method. This recursive invocation produces a second, spurious call to
the Release method of a reference-counted object, causing a UAF when that
object is freed prematurely. This vulnerability pattern has been popularized as
"Double Kill". [REF-1099]
https://www.cve.org/CVERecord?id=CVE-2018-8174
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Related Attack Patterns
CAPEC-ID Attack Pattern Name
74 Manipulating State
References
[REF-1098]Jack Tang. "Root Cause Analysis of CVE-2014-1772 - An Internet Explorer Use
After Free Vulnerability". 2014 November 5. < https://www.trendmicro.com/en_us/research.html
>.2023-04-07.
[REF-1099]Simon Zuckerbraun. "It's Time To Terminate The Terminator". 2018 May 5. < https://
www.zerodayinitiative.com/blog/2018/5/15/its-time-to-terminate-the-terminator >.
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned
Device
Weakness ID : 1266
Structure : Simple
CWE Version 4.14
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device