CWE-621 变量抽取错误

Variable Extraction Error

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.

扩展描述

For example, in PHP, extraction can be used to provide functionality similar to register_globals, a dangerous functionality that is frequently disabled in production systems. Calling extract() or import_request_variables() without the proper arguments could allow arbitrary global variables to be overwritten, including superglobals.

Similar functionality is possible in other interpreted languages, including custom languages.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 914 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 914 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: CanPrecede cwe_CWE_ID: 471 cwe_View_ID: 1000

适用平台

Language: {'cwe_Name': 'PHP', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Integrity Modify Application Data An attacker could modify sensitive data or program variables.

可能的缓解方案

Implementation

策略: Input Validation

Use whitelists of variable names that can be extracted.

Implementation

策略:

Consider refactoring your code to avoid extraction routines altogether.

Implementation

策略:

In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument. Note that these capabilities are not present in all PHP versions.

示例代码

例

This code uses the credentials sent in a POST request to login a user.

bad PHP


//Log user in, and set $isAdmin to true if user is an administrator
function login($user,$pass){
$query = buildQuery($user,$pass);
mysql_query($query);
if(getUserRole($user) == "Admin"){
$isAdmin = true;
}
}

$isAdmin = false;
extract($_POST);
login(mysql_real_escape_string($user),mysql_real_escape_string($pass));

The call to extract() will overwrite the existing values of any variables defined previously, in this case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin" equal to "true", thus gaining Admin privileges.

分析过的案例

标识 说明 链接
CVE-2006-7135 extract issue enables file inclusion https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7135
CVE-2006-7079 extract used for register_globals compatibility layer, enables path traversal https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7079
CVE-2007-0649 extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0649
CVE-2006-6661 extract() enables static code injection https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6661
CVE-2006-2828 import_request_variables() buried in include files makes post-disclosure analysis confusing https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2828

Notes

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command