1086
A product system should be reluctant to trust variables that have been initialized outside of its
trust boundary. Ensure adequate checking (e.g. input validation) is performed when relying on
input from outside a trust boundary.
Phase: Architecture and Design
Avoid any external control of variables. If necessary, restrict the variables that can be modified
using an allowlist, and use a different namespace or naming convention if possible.
Demonstrative Examples
Example 1:
In the Java example below, a system property controls the debug level of the application.
Example Language: Java (Bad)
int debugLevel = Integer.getInteger("com.domain.application.debugLevel").intValue();
If an attacker is able to modify the system property, then it may be possible to coax the application
into divulging sensitive information by virtue of the fact that additional debug information is printed/
exposed as the debug level increases.
Example 2:
This code checks the HTTP POST request for a debug switch, and enables a debug mode if the
switch is set.
Example Language: PHP (Bad)
$debugEnabled = false;
if ($_POST["debug"] == "true"){
$debugEnabled = true;
}
/.../
function login($username, $password){
if($debugEnabled){
echo 'Debug Activated';
phpinfo();
$isAdmin = True;
return True;
}
}
Any user can activate the debug mode, gaining administrator privileges. An attacker may also use
the information printed by the phpinfo() function to further exploit the system. .
This example also exhibits Information Exposure Through Debug Information (CWE-215)
Observed Examples
Reference Description
CVE-2022-43468 WordPress module sets internal variables based on external inputs, allowing
false reporting of the number of views
https://www.cve.org/CVERecord?id=CVE-2022-43468
CVE-2000-0959 Does not clear dangerous environment variables, enabling symlink attack.
https://www.cve.org/CVERecord?id=CVE-2000-0959
CVE-2001-0033 Specify alternate configuration directory in environment variable, enabling
untrusted path.
https://www.cve.org/CVERecord?id=CVE-2001-0033
CVE-2001-0872 Dangerous environment variable not cleansed.
https://www.cve.org/CVERecord?id=CVE-2001-0872
CVE-2001-0084 Specify arbitrary modules using environment variable.
https://www.cve.org/CVERecord?id=CVE-2001-0084
CWE Version 4.14
CWE-455: Non-exit on Failed Initialization
CWE-455: Non-exit on Failed Initialization