Improperly Controlled Modification of Dynamically-Determined Object Attributes

Opis

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability.

This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, autobinding, or object injection.

Inne nazwy

Mass Assignment

"Mass assignment" is the name of a feature in Ruby on Rails that allows simultaneous modification of multiple object attributes.

AutoBinding

The "Autobinding" term is used in frameworks such as Spring MVC and ASP.NET MVC.

PHP Object Injection

Some PHP application researchers use this term for attacking unsafe use of the unserialize() function, but it is also used for CWE-502.

Skutki

• Integrity

  Modify Application Data

  An attacker could modify sensitive data or program variables.

• Integrity

  Execute Unauthorized Code or Commands

• Other, Integrity

  Varies by Context; Alter Execution Logic

Zapobieganie

• Implementation

  If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.

  For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.

• Architecture and Design, Implementation

  If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

• Implementation · Input Validation

  For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

• Implementation, Architecture and Design · Refactoring

  Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.

Przykłady podatności

• CVE-2024-3283 Application for using LLMs allows modification of a sensitive variable using mass assignment.
• CVE-2012-2054 Mass assignment allows modification of arbitrary attributes using modified URL.
• CVE-2012-2055 Source version control product allows modification of trusted key using mass assignment.
• CVE-2008-7310 Attackers can bypass payment step in e-commerce product.
• CVE-2013-1465 Use of PHP unserialize function on untrusted input allows attacker to modify application configuration.
• CVE-2012-3527 Use of PHP unserialize function on untrusted input in content management system might allow code execution.
• CVE-2012-0911 Use of PHP unserialize function on untrusted input in content management system allows code execution using a crafted cookie value.
• CVE-2012-0911 Content management system written in PHP allows unserialize of arbitrary objects, possibly allowing code execution.
• CVE-2011-4962 Content management system written in PHP allows code execution through page comments.
• CVE-2009-4137 Use of PHP unserialize function on cookie value allows remote code execution or upload of arbitrary files.
• CVE-2007-5741 Content management system written in Python interprets untrusted data as pickles, allowing code execution.
• CVE-2011-2520 Python script allows local users to execute code via pickled data.
• CVE-2005-2875 Python script allows remote attackers to execute arbitrary code using pickled objects.
• CVE-2013-0277 Ruby on Rails allows deserialization of untrusted YAML to execute arbitrary code.
• CVE-2011-2894 Spring framework allows deserialization of objects from untrusted sources to execute arbitrary code.
• CVE-2012-1833 Grails allows binding of arbitrary parameters to modify arbitrary object properties.
• CVE-2010-3258 Incorrect deserialization in web browser allows escaping the sandbox.
• CVE-2008-1013 Media library allows deserialization of objects by untrusted Java applets, leading to arbitrary code execution.

Słabość nadrzędna

• CWE-913 Improper Control of Dynamically-Managed Code Resources

Pokrewna

• CWE-502 Deserialization of Untrusted Data

Słabości podrzędne

• CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Ruby, ASP.NET, PHP, Python, Not Language-Specific, Not Technology-Specific

Uwagi

The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more narrowly scoped to object modification, and is not necessarily used for deserialization.

Źródła

1. Shocking News in PHP Exploitation — Stefan Esser, 2009
2. "Two Security Vulnerabilities in the Spring Framework's MVC" pdf (from 2008) — Dinis Cruz
3. Two Security Vulnerabilities in the Spring Framework's MVC — Ryan Berg, Dinis Cruz
4. Best Practices for ASP.NET MVC — ASPNETUE, 2010
5. Mass assignment in Rails applications — Michael Hartl, 2008
6. Secure your Rails apps! — Tobi, 2012
7. Ruby On Rails Security Guide — Heiko Webers
8. Mass Assignment Vulnerability in ASP.NET MVC — Josh Bush, 2012
9. 6 Ways To Avoid Mass Assignment in ASP.NET MVC — K. Scott Allen, 2012
10. PHP Object Injection — Egidio Romano, 2013
11. Unserializing user-supplied data, a bad idea — Heine Deelstra, 2010
12. Why Python Pickle is Insecure — Nadia Alramli, 2009