Variable Extraction Error

Opis

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.

For example, in PHP, extraction can be used to provide functionality similar to register_globals, a dangerous functionality that is frequently disabled in production systems. Calling extract() or import_request_variables() without the proper arguments could allow arbitrary global variables to be overwritten, including superglobals.

Similar functionality is possible in other interpreted languages, including custom languages.

Inne nazwy

Variable overwrite

Skutki

• Integrity

  Modify Application Data

  An attacker could modify sensitive data or program variables.

Zapobieganie

• Implementation · Input Validation

  Use allowlists of variable names that can be extracted.

• Implementation · Refactoring

  Consider refactoring your code to avoid extraction routines altogether.

• Implementation

  In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument. Note that these capabilities are not present in all PHP versions.

Przykłady podatności

• CVE-2006-7135 extract issue enables file inclusion
• CVE-2006-7079 Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22)
• CVE-2007-0649 extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.
• CVE-2006-6661 extract() enables static code injection
• CVE-2006-2828 import_request_variables() buried in include files makes post-disclosure analysis confusing

Słabość nadrzędna

• CWE-914 Improper Control of Dynamically-Identified Variables

Może prowadzić do

• CWE-471 Modification of Assumed-Immutable Data (MAID)

Kiedy powstaje

• Implementation

Dotyczy

PHP

Uwagi

Probably under-reported for PHP. Seems under-studied for other interpreted languages.