Kingdom: Input Validation and Representation

Input validation and representation problems ares caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others.

Possible Variable Overwrite

ColdFusion

Abstract

The program invokes a function that can overwrite variables, which can open the door for attackers.

Explanation

Functions that can overwrite variables that are already initialized can allow an attacker to influence the execution of code that relies on the overwritten variables.
can overwrite variables.

Example 1: If an attacker supplies a malicious value for varName in the following segment of ColdFusion code, then the call to SetVariable() might overwrite any arbitrary variables, including #first#. In this case, if a malicious value that contains JavaScript overwrites #first#, then the program is vulnerable to cross-site scripting.


<cfset first = "User">
<cfscript>
SetVariable(url.varName, url.varValue);
</cfscript>
<cfoutput>
#first#
</cfoutput>

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 473

[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001310

[3] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[6] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4

[7] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[13] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[14] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[16] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002530 CAT II

desc.dataflow.cfml.possible_variable_overwrite