1124
applications often mistakenly make the assumption that data passed to the client in hidden fields or
cookies is not susceptible to tampering. Improper validation of data that are user-controllable can
lead to the application processing incorrect, and often malicious, input.
For example, custom cookies commonly store session data or persistent data across sessions.
This kind of session data is normally involved in security related decisions on the server side, such
as user authentication and access control. Thus, the cookies might contain sensitive data such
as user credentials and privileges. This is a dangerous practice, as it can often lead to improper
reliance on the value of the client-provided cookie by the server side application.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 471 Modification of Assumed-Immutable Data (MAID) 1121
ChildOf 642 External Control of Critical State Data 1414
CanFollow 656 Reliance on Security Through Obscurity 1444
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 19 Data Processing Errors 2309
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Assumed-Immutable Parameter Tampering :
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Without appropriate protection mechanisms, the client
can easily tamper with cookies and similar web data.
Reliance on the cookies without detailed validation
can lead to problems such as SQL injection. If you use
cookie values for security related decisions on the server
side, manipulating the cookies might lead to violations
of security policies such as authentication bypassing,
user impersonation and privilege escalation. In addition,
storing sensitive data in the cookie without appropriate
protection can also lead to disclosure of sensitive user
data, especially data stored in persistent cookies.
Detection Methods
Automated Static Analysis
CWE Version 4.14
CWE-472: External Control of Assumed-Immutable Web Parameter
CWE-472: External Control of Assumed-Immutable Web Parameter