What is External Control of Assumed-Immutable (CWE-472)?

TL;DR: External Control of Assumed-Immutable Web Parameter (CWE-472) is a web application vulnerability where inputs assumed immutable can be externally manipulated, leading to security breaches. Proper validation and verification prevent this.

What is External Control of Assumed-Immutable Web Parameter?

External Control of Assumed-Immutable Web Parameter (CWE-472) is a type of vulnerability where web applications do not sufficiently verify inputs that are assumed to be immutable but can actually be externally controlled. As defined by the MITRE Corporation under CWE-472, and classified by the OWASP Foundation under A06:2025 - Insecure Design.

Quick Summary

External Control of Assumed-Immutable Web Parameter is a critical security flaw where web applications trust inputs that should not be externally modifiable. This can lead to unauthorized data modifications, authentication bypasses, user impersonation, privilege escalation, and sensitive information disclosure. Jump to: Overview · How it Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes

Jump to: Quick Summary · External Control of Assumed-Immutable Web Parameter Overview · How External Control of Assumed-Immutable Web Parameter Works · Business Impact of External Control of Assumed-Immutable Web Parameter · External Control of Assumed-Immutable Web Parameter Attack Scenario · How to Detect External Control of Assumed-Immutable Web Parameter · How to Fix External Control of Assumed-Immutable Web Parameter · Framework-Specific Fixes for External Control of Assumed-Immutable Web Parameter · How to Ask AI to Check Your Code for External Control of Assumed-Immutable Web Parameter · External Control of Assumed-Immutable Web Parameter Best Practices Checklist · External Control of Assumed-Immutable Web Parameter FAQ · Vulnerabilities Related to External Control of Assumed-Immutable Web Parameter · References · Scan Your Own Site

External Control of Assumed-Immutable Web Parameter Overview

What

External Control of Assumed-Immutable Web Parameter is a vulnerability where web applications do not properly validate inputs that are assumed to be immutable but can actually be externally controlled.

Why it matters

This vulnerability allows attackers to manipulate supposedly immutable parameters, such as hidden form fields or cookies, leading to data tampering and security breaches. Proper validation prevents unauthorized access and ensures application integrity.

Where it occurs

Web applications that rely on hidden form fields, session tokens, or other assumed-immutable inputs without proper validation are vulnerable.

Who is affected

Developers and organizations using web applications with insufficient input validation for supposedly immutable parameters.

Who is NOT affected

Applications that strictly validate all user inputs before processing them.

How External Control of Assumed-Immutable Web Parameter Works

Root Cause

The root cause lies in the assumption that certain inputs are immutable when they can actually be externally controlled. This leads to insufficient validation and verification, allowing attackers to manipulate these parameters.

Attack Flow

1. Attacker identifies an input assumed to be immutable but is not properly validated.
2. Attacker manipulates this input through direct modification or injection attacks.
3. Application processes the manipulated input without proper validation, leading to security breaches.

   Prerequisites to Exploit

   • Inputs that are assumed to be immutable must actually be externally controllable.
   • The application does not validate these inputs before processing them.

     Vulnerable Code

     def process_form_data(request):
      hidden_field = request.form.get('hidden_field', '')
      # Assume 'hidden_field' is immutable and use it directly in the application logic
     

     This code assumes that hidden_field cannot be tampered with, but an attacker can manipulate this value.

     Secure Code

     def process_form_data(request):
      hidden_field = request.form.get('hidden_field', '')
      if not validate_immutable_input(hidden_field):
        raise ValueError("Invalid or manipulated input")
     

     The secure code checks the hidden_field against a predefined set of acceptable values before proceeding.

Business Impact of External Control of Assumed-Immutable Web Parameter

Confidentiality

Attackers can manipulate cookies and session tokens to gain unauthorized access to sensitive information.

Integrity

Data integrity is compromised as attackers can modify supposedly immutable parameters, leading to incorrect application state.

Availability

Availability may be impacted if manipulation leads to denial-of-service conditions or unexpected application behavior.

External Control of Assumed-Immutable Web Parameter Attack Scenario

1. Attacker identifies a hidden form field assumed to be immutable in the web application.
2. Using browser developer tools, attacker modifies this field and submits the form.
3. Application processes the manipulated input without validation, leading to unauthorized access or data tampering.

How to Detect External Control of Assumed-Immutable Web Parameter

Manual Testing

• Check for proper validation of hidden form fields and cookies before use.
• Verify that all inputs assumed immutable are validated against known good values.

  Automated Scanners (SAST/DAST)

  Static analysis can detect unvalidated inputs, while dynamic testing verifies actual behavior during runtime.

  PenScan Detection

  PenScan’s automated scanners actively test for this vulnerability using tools like ZAP and Wapiti.

  False Positive Guidance

  False positives occur when the application properly validates immutable inputs. Ensure that validation logic is in place before marking findings as false positives.

How to Fix External Control of Assumed-Immutable Web Parameter

• Implement strict input validation for all assumed-immutable inputs.
• Reject invalid or unexpected values and ensure proper validation before processing any data modifications.

Framework-Specific Fixes for External Control of Assumed-Immutable Web Parameter

Python/Django

def validate_immutable_input(value):
    if value not in ALLOWED_VALUES:
        raise ValueError("Invalid input")

Ensure that all inputs assumed immutable are validated against a predefined set of acceptable values.

How to Ask AI to Check Your Code for External Control of Assumed-Immutable Web Parameter

External Control of Assumed-Immutable Web Parameter Best Practices Checklist

✅ Implement strict input validation for all assumed-immutable inputs. ✅ Reject invalid or unexpected values before processing any data modifications. ✅ Ensure proper validation logic is in place before assuming immutable parameters.

External Control of Assumed-Immutable Web Parameter FAQ

How does external control of assumed-immutable web parameter work?

Attackers manipulate supposedly immutable parameters, such as hidden form fields or cookies, to alter application state and bypass security measures.

What are the common consequences of CWE-472?

This vulnerability can lead to unauthorized data modifications, authentication bypasses, user impersonation, privilege escalation, and sensitive information disclosure.

How do I detect external control of assumed-immutable web parameter in my application?

Use static analysis tools to identify unvalidated inputs that are assumed immutable. Manual testing involves checking for proper validation of form fields and cookies.

What is the best way to prevent CWE-472 vulnerabilities?

Implement strict input validation, reject invalid or unexpected values, and ensure all data modifications are properly validated before being processed by the application.

Can you provide an example of vulnerable code for CWE-472?

An example would be a form field that is assumed to be immutable but can still be manipulated by attackers through direct input manipulation or injection attacks.

What are some common mistakes developers make when dealing with CWE-472?

Common mistakes include relying on client-side validation, assuming hidden fields cannot be tampered with, and not properly validating cookie values before use.

How can I test for external control of assumed-immutable web parameter in my application?

Test by attempting to manipulate form fields or cookies directly through the browser’s developer tools and observe if the application state changes unexpectedly.

Vulnerabilities Related to External Control of Assumed-Immutable Web Parameter

| CWE | Name | Relationship | |—|—|—| | 642 | External Control of Critical State Data (ChildOf) | ChildOf | | 471 | Modification of Assumed-Immutable Data (MAID) (ParentOf) | ParentOf |

References

• MITRE
• OWASP Insecure Design A06
• CAPEC 146, 226, 31, 39
• NVD NIST

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find External Control of Assumed-Immutable Web Parameter and other risks before an attacker does.