2283
Example Language: PHP (Bad)
// $user and $pass automatically set from POST request
if (login_user($user,$pass)) {
$authorized = true;
}
...
if ($authorized) {
generatePage();
}
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any
value included in the POST request if register_globals is enabled. An attacker can send a POST
request with an unexpected third value 'authorized' set to 'true' and gain authorized status without
supplying valid credentials.
Here is a fixed version:
Example Language: PHP (Good)
$user = $_POST['user'];
$pass = $_POST['pass'];
$authorized = false;
if (login_user($user,$pass)) {
$authorized = true;
}
...
This code avoids the issue by initializing the $authorized variable to false and explicitly retrieving
the login credentials from the $_POST variable. Regardless, register_globals should never be
enabled and is disabled by default in current versions of PHP.
Observed Examples
Reference Description
CVE-2020-27211 Chain: microcontroller system-on-chip uses a register value stored in flash
to set product protection state on the memory bus and does not contain
protection against fault injection (CWE-1319) which leads to an incorrect
initialization of the memory bus (CWE-1419) causing the product to be in an
unprotected state.
https://www.cve.org/CVERecord?id=CVE-2020-27211
CVE-2023-25815 chain: a change in an underlying package causes the gettext function to use
implicit initialization with a hard-coded path (CWE-1419) under the userwritable
C:\ drive, introducing an untrusted search path element (CWE-427)
that enables spoofing of messages.
https://www.cve.org/CVERecord?id=CVE-2023-25815
CVE-2022-43468 WordPress module sets internal variables based on external inputs, allowing
false reporting of the number of views
https://www.cve.org/CVERecord?id=CVE-2022-43468
CVE-2022-36349 insecure default variable initialization in BIOS firmware for a hardware board
allows DoS
https://www.cve.org/CVERecord?id=CVE-2022-36349
CVE-2015-7763 distributed filesystem only initializes part of the variable-length padding for a
packet, allowing attackers to read sensitive information from previously-sent
packets in the same memory location
https://www.cve.org/CVERecord?id=CVE-2015-7763
MemberOf Relationships
CWE Version 4.14
CWE-1420: Exposure of Sensitive Information during Transient Execution
CWE-1420: Exposure of Sensitive Information during Transient Execution