What is External Control of Critical State Data (CWE-642)?

TL;DR: External Control of Critical State Data (CWE-642) is a security vulnerability where unauthorized actors can modify critical state information, leading to privilege escalation and exposure of sensitive data. Store this data securely on the server side.

What is External Control of Critical State Data?

External Control of Critical State Data (CWE-642) is a security vulnerability where critical state data about users or the system itself can be modified by unauthorized actors. As defined by the MITRE Corporation under CWE-642, and classified by the OWASP Foundation under A06:2025 - Insecure Design.

Quick Summary

External Control of Critical State Data is a high-severity vulnerability that allows attackers to modify critical state data, leading to privilege escalation or unauthorized access. This can compromise confidentiality, integrity, and availability. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · External Control of Critical State Data Overview · How External Control of Critical State Data Works · Business Impact of External Control of Critical State Data · External Control of Critical State Data Attack Scenario · How to Detect External Control of Critical State Data · How to Fix External Control of Critical State Data · Framework-Specific Fixes for External Control of Critical State Data · How to Ask AI to Check Your Code for External Control of Critical State Data · External Control of Critical State Data Best Practices Checklist · External Control of Critical State Data FAQ · Vulnerabilities Related to External Control of Critical State Data · References · Scan Your Own Site

External Control of Critical State Data Overview

What

External Control of Critical State Data is a security vulnerability where critical state data can be modified by unauthorized actors.

Why it matters

This vulnerability allows attackers to bypass protection mechanisms, gain elevated privileges or assume identities, and expose sensitive information. It compromises confidentiality, integrity, and availability.

Where it occurs

In applications that store security-critical state information in client-side storage or environment variables accessible to attackers.

Who is affected

Applications that improperly manage critical state data, such as session tokens or user roles.

Who is NOT affected

Systems where state information is securely stored on the server side and protected from unauthorized access.

How External Control of Critical State Data Works

Root Cause

The root cause is storing security-critical state information in a location accessible to attackers.

Attack Flow

1. Attacker identifies critical state data.
2. Modifies or manipulates this data.
3. Bypasses authentication mechanisms and gains elevated privileges.

Prerequisites to Exploit

• The attacker must have access to the location where critical state data is stored.
• The application does not validate or protect this data from unauthorized modifications.

Vulnerable Code

// Example of vulnerable PHP code
session_start();
$_SESSION['admin'] = $_GET['role'];

This example shows how an attacker can set the admin flag in a session by manipulating the role parameter, leading to privilege escalation.

Secure Code

// Example of secure PHP code
session_start();
if ($_SERVER['REMOTE_ADDR'] == 'trusted_ip') {
    $_SESSION['admin'] = true;
} else {
    $_SESSION['user'] = true;
}

This secure version ensures that the admin flag can only be set from a trusted IP address, preventing unauthorized modifications.

Business Impact of External Control of Critical State Data

Confidentiality

• Data Exposure: Sensitive information like session tokens or user roles may be exposed.
• Example Scenario: An attacker modifies a user’s role to gain admin access and reads sensitive data.

Integrity

• State Manipulation: Unauthorized modification of critical state data can lead to incorrect system behavior.
• Example Scenario: An attacker alters a payment status from “pending” to “completed,” causing financial discrepancies.

Availability

• Denial of Service: Malicious modifications may cause unexpected errors or crashes, leading to service disruptions.
• Example Scenario: An attacker tampers with critical configuration settings, resulting in system instability and downtime.

External Control of Critical State Data Attack Scenario

1. The attacker identifies a session token stored on the client side.
2. Modifies the session token to assume an admin role.
3. Uses the modified token to gain unauthorized access to administrative features.
4. Bypasses authentication mechanisms, leading to full control over the system.

How to Detect External Control of Critical State Data

Manual Testing

• Check if critical state data is stored in client-side storage or environment variables.
• Verify that all modifications to critical state data are validated and authorized.
• Ensure that sensitive information is encrypted and integrity-checked before use.

Automated Scanners (SAST / DAST)

Static analysis can detect improper storage of critical state data, while dynamic testing verifies actual vulnerabilities in a running application.

PenScan Detection

PenScan’s scanners such as ZAP and Wapiti can identify instances where critical state data is improperly stored or modified.

False Positive Guidance

A false positive may occur if the code appears to store sensitive information but has additional checks that prevent unauthorized access. Verify these protections are in place before dismissing findings.

How to Fix External Control of Critical State Data

• Store critical state data on the server side.
• Use message authentication codes (MACs) to ensure integrity and authenticity of data exposed to clients.
• Define clear rules for legitimate state transitions and enforce them strictly.
• Ensure that application users cannot affect state directly except through legitimate actions.

Framework-Specific Fixes for External Control of Critical State Data

PHP

session_start();
if (isset($_SESSION['user'])) {
    $_SESSION['admin'] = false;
} else if ($_SERVER['REMOTE_ADDR'] == 'trusted_ip') {
    $_SESSION['admin'] = true;
}

This ensures that only trusted IP addresses can set the admin flag, preventing unauthorized modifications.

ASP.NET

Session["Admin"] = User.IsInRole("Administrator");

Ensure that critical state data is managed securely on the server side and not exposed to client-side manipulation.

How to Ask AI to Check Your Code for External Control of Critical State Data

External Control of Critical State Data Best Practices Checklist

✅ Store critical state data securely on the server side. ✅ Use message authentication codes (MACs) to ensure integrity and authenticity of exposed data. ✅ Define clear rules for legitimate state transitions and enforce them strictly. ✅ Ensure that application users cannot affect state directly except through legitimate actions. ✅ Verify all modifications to critical state data are validated and authorized.

External Control of Critical State Data FAQ

How does external control of critical state data work?

It occurs when a product stores security-critical state information in an accessible location, allowing unauthorized actors to modify it.

What are the common consequences of external control of critical state data?

This can lead to bypassing protection mechanisms and gaining elevated privileges or assuming identities. Confidentiality is also compromised as sensitive information may be exposed.

How does insecure design contribute to this vulnerability?

Insecure design often results in storing critical state data where it’s accessible to unauthorized users, such as client-side storage or environment variables.

Can you provide an example of external control of critical state data in a real-world application?

An attacker can modify user session tokens stored on the client side to gain unauthorized access to another user’s account.

How do I detect external control of critical state data vulnerabilities?

Use static analysis tools and manual code reviews to identify where security-critical state information is stored improperly.

What are some best practices for preventing external control of critical state data?

Store sensitive state information on the server side, use message authentication codes (MACs), and ensure that the system tracks its own state unambiguously.

How can I ask an AI to check my code for external control of critical state data vulnerabilities?

Use a prompt like “Review this Python code for potential CWE-642 External Control of Critical State Data vulnerabilities.”

Vulnerabilities Related to External Control of Critical State Data

References

• MITRE: CWE-642
• OWASP Top 10 A06: Insecure Design
• CAPEC-21, CAPEC-31
• NVD - National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find External Control of Critical State Data and other risks before an attacker does.