CWE-913: Improper Control of Dynamically-Managed Code Resources
Description
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Integrity
Execute Unauthorized Code or Commands
- OtherIntegrity
Varies by Context; Alter Execution Logic
Potential mitigations
- ImplementationInput Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
- ImplementationArchitecture and DesignRefactoring
Refactor the code so that it does not need to be dynamically managed.
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-94Improper Control of Generation of Code ('Code Injection')
- CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
- CWE-502Deserialization of Untrusted Data
- CWE-914Improper Control of Dynamically-Identified Variables
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.