PHP External Variable Modification

Opis

A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

Skutki

• Integrity

  Modify Application Data

Zapobieganie

• Requirements, Implementation

  Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.

Przykłady podatności

• CVE-2000-0860 File upload allows arbitrary file read by setting hidden form variables to match internal variable names.
• CVE-2001-0854 Mistakenly trusts $PHP_SELF variable to determine if include script was called by its parent.
• CVE-2002-0764 PHP remote file inclusion by modified assumed-immutable variable.
• CVE-2001-1025 Modify key variable when calling scripts that don't load a library that initializes it.
• CVE-2003-0754 Authentication bypass by modifying array used for authentication.

Słabość nadrzędna

• CWE-471 Modification of Assumed-Immutable Data (MAID)

Może prowadzić do

• CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

PHP

Uwagi

This is a language-specific instance of Modification of Assumed-Immutable Data (MAID). This can be resultant from direct request (alternate path) issues. It can be primary to weaknesses such as PHP file inclusion, SQL injection, XSS, authentication bypass, and others.