1811
Example 1:
This function sets object attributes based on a dot-separated path.
Example Language: JavaScript (Bad)
function setValueByPath (object, path, value) {
const pathArray = path.split(".");
const attributeToSet = pathArray.pop();
let objectToModify = object;
for (const attr of pathArray) {
if (typeof objectToModify[attr] !== 'object') {
objectToModify[attr] = {};
}
objectToModify = objectToModify[attr];
}
objectToModify[attributeToSet] = value;
return object;
}
This function does not check if the attribute resolves to the object prototype. These codes can be
used to add "isAdmin: true" to the object prototype.
Example Language: JavaScript (Bad)
setValueByPath({}, "__proto__.isAdmin", true)
setValueByPath({}, "constructor.prototype.isAdmin", true)
By using a denylist of dangerous attributes, this weakness can be eliminated.
Example Language: JavaScript (Good)
function setValueByPath (object, path, value) {
const pathArray = path.split(".");
const attributeToSet = pathArray.pop();
let objectToModify = object;
for (const attr of pathArray) {
// Ignore attributes which resolve to object prototype
if (attr === "__proto__" || attr === "constructor" || attr === "prototype") {
continue;
}
if (typeof objectToModify[attr] !== "object") {
objectToModify[attr] = {};
}
objectToModify = objectToModify[attr];
}
objectToModify[attributeToSet] = value;
return object;
}
Observed Examples
Reference Description
CVE-2012-2054 Mass assignment allows modification of arbitrary attributes using modified
URL.
https://www.cve.org/CVERecord?id=CVE-2012-2054
CVE-2012-2055 Source version control product allows modification of trusted key using mass
assignment.
https://www.cve.org/CVERecord?id=CVE-2012-2055
CVE-2008-7310 Attackers can bypass payment step in e-commerce product.
https://www.cve.org/CVERecord?id=CVE-2008-7310
CVE-2013-1465 Use of PHP unserialize function on untrusted input allows attacker to modify
application configuration.
CWE Version 4.14
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-915: Improperly Controlled Modification
of Dynamically-Determined Object Attributes 1812
Reference Description
https://www.cve.org/CVERecord?id=CVE-2013-1465
CVE-2012-3527 Use of PHP unserialize function on untrusted input in content management
system might allow code execution.
https://www.cve.org/CVERecord?id=CVE-2012-3527
CVE-2012-0911 Use of PHP unserialize function on untrusted input in content management
system allows code execution using a crafted cookie value.
https://www.cve.org/CVERecord?id=CVE-2012-0911
CVE-2012-0911 Content management system written in PHP allows unserialize of arbitrary
objects, possibly allowing code execution.
https://www.cve.org/CVERecord?id=CVE-2012-0911
CVE-2011-4962 Content management system written in PHP allows code execution through
page comments.
https://www.cve.org/CVERecord?id=CVE-2011-4962
CVE-2009-4137 Use of PHP unserialize function on cookie value allows remote code execution
or upload of arbitrary files.
https://www.cve.org/CVERecord?id=CVE-2009-4137
CVE-2007-5741 Content management system written in Python interprets untrusted data as
pickles, allowing code execution.
https://www.cve.org/CVERecord?id=CVE-2007-5741
CVE-2011-2520 Python script allows local users to execute code via pickled data.
https://www.cve.org/CVERecord?id=CVE-2011-2520
CVE-2005-2875 Python script allows remote attackers to execute arbitrary code using pickled
objects.
https://www.cve.org/CVERecord?id=CVE-2005-2875
CVE-2013-0277 Ruby on Rails allows deserialization of untrusted YAML to execute arbitrary
code.
https://www.cve.org/CVERecord?id=CVE-2013-0277
CVE-2011-2894 Spring framework allows deserialization of objects from untrusted sources to
execute arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2011-2894
CVE-2012-1833 Grails allows binding of arbitrary parameters to modify arbitrary object
properties.
https://www.cve.org/CVERecord?id=CVE-2012-1833
CVE-2010-3258 Incorrect deserialization in web browser allows escaping the sandbox.
https://www.cve.org/CVERecord?id=CVE-2010-3258
CVE-2008-1013 Media library allows deserialization of objects by untrusted Java applets,
leading to arbitrary code execution.
https://www.cve.org/CVERecord?id=CVE-2008-1013
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Notes
Maintenance
The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more
narrowly scoped to object modification, and is not necessarily used for deserialization.
CWE Version 4.14
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-916: Use of Password Hash With Insufficient Computational Effort