1416
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use
some frameworks can maintain the state for you. Examples include ASP.NET View State and
the OWASP ESAPI Session Management feature. Be careful of language features that provide
state support, since these might be provided as a convenience to the programmer and may not
be considering security.
Phase: Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are
duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side
checks by modifying values after the checks have been performed, or by changing the client to
remove the client-side checks entirely. Then, these modified values would be submitted to the
server.
Phase: Operation
Phase: Implementation
Strategy = Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During
implementation, develop the application so that it does not rely on this feature, but be wary of
implementing a register_globals emulation that is subject to weaknesses such as CWE-95,
CWE-621, and similar issues.
Phase: Testing
Use automated static analysis tools that target this type of weakness. Many modern techniques
use data flow analysis to minimize the number of false positives. This is not a perfect solution,
since 100% accuracy and coverage are not feasible.
Phase: Testing
Use dynamic tools and techniques that interact with the product using large test suites with
many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The
product's operation may slow down, but it should not become unstable, crash, or generate
incorrect results.
Phase: Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing,
threat modeling, and interactive tools that allow the tester to record and modify an active session.
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Demonstrative Examples
Example 1:
In the following example, an authentication flag is read from a browser cookie, thus allowing for
external control of user state data.
Example Language: Java (Bad)
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("authenticated") && Boolean.TRUE.equals(c.getValue())) {
authenticated = true;
}
}
Example 2:
CWE Version 4.14
CWE-642: External Control of Critical State Data
CWE-642: External Control of Critical State Data