CWE-913: Improper Control of Dynamically-Managed Code Resources

Description

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.

Potential Impact

Integrity

Execute Unauthorized Code or Commands

Other, Integrity

Varies by Context, Alter Execution Logic

Demonstrative Examples

This example attempts to write user messages to a message file and allow users to view them.

Bad

$MessageFile = "messages.out";if ($_GET["action"] == "NewMessage") {$name = $_GET["name"];$message = $_GET["message"];$handle = fopen($MessageFile, "a+");fwrite($handle, "<b>$name</b> says '$message'<hr>\n");fclose($handle);echo "Message Saved!<p>\n";}else if ($_GET["action"] == "ViewMessages") {include($MessageFile);}

While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:

Attack

name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

which will decode to the following:

Attack

<?php system("/bin/ls -l");?>

The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.

Notice that XSS (CWE-79) is also possible in this situation.

A common reason that programmers use the
               reflection API is to implement their own command
               dispatcher. The following example shows a command
               dispatcher that does not use reflection:

Good

String ctl = request.getParameter("ctl");
				  Worker ao = null;
				  if (ctl.equals("Add")) {
				  
				  ao = new AddCommand();
				  
				  }
				  else if (ctl.equals("Modify")) {
				  
				  ao = new ModifyCommand();
				  
				  }
				  else {
				  
				  throw new UnknownActionError();
				  }
				  
				  ao.doAction(request);

A programmer might refactor this code to use reflection as follows:

Bad

String ctl = request.getParameter("ctl");
					Class cmdClass = Class.forName(ctl + "Command");
					Worker ao = (Worker) cmdClass.newInstance();
					ao.doAction(request);

One way to address this access control
               problem is to make the Worker object responsible for
               performing the access control check. An example of the
               re-refactored code follows:

Bad

String ctl = request.getParameter("ctl");
				   Class cmdClass = Class.forName(ctl + "Command");
				   Worker ao = (Worker) cmdClass.newInstance();
				   ao.checkAccessControl(request);
				   ao.doAction(request);

Although this is an improvement, it
               encourages a decentralized approach to access control,
               which makes it easier for programmers to make access
               control mistakes.

This code also highlights another security
			   problem with using reflection to build a command
			   dispatcher. An attacker can invoke the default
			   constructor for any kind of object. In fact, the
			   attacker is not even constrained to objects that
			   implement the Worker interface; the default constructor
			   for any object in the system can be invoked. If the
			   object does not implement the Worker interface, a
			   ClassCastException will be thrown before the assignment
			   to ao, but if the constructor performs operations that
			   work in the attacker's favor, the damage will already
			   have been done. Although this scenario is relatively
			   benign in simple products, in larger products where
			   complexity grows exponentially, it is not unreasonable
			   that an attacker could find a constructor to leverage
			   as part of an attack.

Mitigations & Prevention

Implementation

For any externally-influenced input, check the input against an allowlist of acceptable values.

ImplementationArchitecture and Design

Refactor the code so that it does not need to be dynamically managed.

Detection Methods

Fuzzing High — Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption,

Real-World CVE Examples

CVE ID	Description
CVE-2022-2054	Python compiler uses eval() to execute malicious strings as Python code.
CVE-2018-1000613	Cryptography API uses unsafe reflection when deserializing a private key
CVE-2015-8103	Deserialization issue in commonly-used Java library allows remote execution.
CVE-2006-7079	Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
CVE-2012-2055	Source version control product allows modification of trusted key using mass assignment.

Frequently Asked Questions

What is CWE-913?

CWE-913 (Improper Control of Dynamically-Managed Code Resources) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statement...

How can CWE-913 be exploited?

Attackers can exploit CWE-913 (Improper Control of Dynamically-Managed Code Resources) to execute unauthorized code or commands. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-913?

Key mitigations include: For any externally-influenced input, check the input against an allowlist of acceptable values.

What is the severity of CWE-913?

CWE-913 is classified as a Class-level weakness (High abstraction). It has been observed in 5 real-world CVEs.