What is External Control of System (CWE-15)?

TL;DR: External Control of System or Configuration Setting (CWE-15) is a type of Security Misconfiguration vulnerability that occurs when one or more system settings or configuration elements can be externally controlled by a user. This vulnerability can lead to unauthorized access, data breaches, and system crashes.

What is External Control of System or Configuration Setting?

External Control of System or Configuration Setting (CWE-15) is a type of Security Misconfiguration vulnerability that occurs when one or more system settings or configuration elements can be externally controlled by a user. As defined by the MITRE Corporation under CWE-15, and classified by the OWASP Foundation under A02:2025 - Security Misconfiguration.

Quick Summary

External Control of System or Configuration Setting (CWE-15) is a critical vulnerability that can lead to unauthorized access, data breaches, and system crashes. It occurs when one or more system settings or configuration elements can be externally controlled by a user. The primary prevention technique for External Control of System or Configuration Setting is Separation of Privilege.

Jump to: Quick Summary · External Control of System or Configuration Setting Overview · How External Control of System or Configuration Setting Works · Business Impact of External Control of System or Configuration Setting · External Control of System or Configuration Setting Attack Scenario · How to Detect External Control of System or Configuration Setting · How to Fix External Control of System or Configuration Setting · Framework-Specific Fixes for External Control of System or Configuration Setting · How to Ask AI to Check Your Code for External Control of System or Configuration Setting · External Control of System or Configuration Setting Best Practices Checklist · External Control of System or Configuration Setting FAQ · Vulnerabilities Related to External Control of System or Configuration Setting · References

External Control of System or Configuration Setting Overview

What: External Control of System or Configuration Setting (CWE-15) is a type of Security Misconfiguration vulnerability that occurs when one or more system settings or configuration elements can be externally controlled by a user.

Why it matters: This vulnerability can lead to unauthorized access, data breaches, and system crashes, resulting in significant financial losses and reputational damage.

Where it occurs: External Control of System or Configuration Setting (CWE-15) can occur in web applications, APIs, microservices, and other systems that rely on configuration settings.

Who is affected: Any user who has access to the system’s configuration settings can potentially exploit this vulnerability.

Who is NOT affected: Users who do not have access to the system’s configuration settings are not affected by External Control of System or Configuration Setting (CWE-15).

How External Control of System or Configuration Setting Works

Root Cause

External Control of System or Configuration Setting (CWE-15) occurs when one or more system settings or configuration elements can be externally controlled by a user.

Attack Flow

1. An attacker gains access to the system’s configuration settings.
2. The attacker modifies the configuration settings to their advantage.
3. The modified configuration settings are applied, leading to unauthorized access, data breaches, and system crashes.

Prerequisites to Exploit

• The attacker must have access to the system’s configuration settings.
• The attacker must be able to modify the configuration settings.

Vulnerable Code

config['debug'] = request.form['debug']

This code snippet demonstrates how an attacker can exploit External Control of System or Configuration Setting (CWE-15) by modifying the debug setting in the system’s configuration.

Secure Code

if not os.path.abspath(path).startswith(base_dir):
  raise ValueError('Invalid path')
else:
  config['debug'] = False

This code snippet demonstrates how to securely set the debug setting in the system’s configuration by validating the input and preventing unauthorized access.

Business Impact of External Control of System or Configuration Setting

External Control of System or Configuration Setting (CWE-15) can lead to:

• Unauthorized access: Attackers can gain access to sensitive data and systems.
• Data breaches: Sensitive information can be stolen, leading to reputational damage and financial losses.
• System crashes: Modified configuration settings can cause system crashes, leading to downtime and financial losses.

External Control of System or Configuration Setting Attack Scenario

1. An attacker gains access to the system’s configuration settings.
2. The attacker modifies the configuration settings to their advantage.
3. The modified configuration settings are applied, leading to unauthorized access, data breaches, and system crashes.

How to Detect External Control of System or Configuration Setting

Manual Testing

• Review the system’s configuration settings for any suspicious changes.
• Verify that all users have been properly authorized to modify configuration settings.

Automated Scanners (SAST / DAST)

• Use automated scanning tools to detect any potential vulnerabilities in the system’s configuration settings.
• Regularly update and patch the system to prevent exploitation.

PenScan Detection

PenScan’s scanner engines can detect External Control of System or Configuration Setting (CWE-15) by analyzing the system’s configuration settings for any suspicious changes.

False Positive Guidance

To avoid false positives, ensure that all users have been properly authorized to modify configuration settings and that all modifications are thoroughly reviewed.

How to Fix External Control of System or Configuration Setting

• Implement Separation of Privilege to prevent unauthorized access.
• Validate user input to prevent modification of configuration settings.
• Regularly update and patch the system to prevent exploitation.

Framework-Specific Fixes for External Control of System or Configuration Setting

Java

@RolesAllowed("admin")
public void setDebug(boolean debug) {
  if (debug) {
    config['debug'] = true;
  } else {
    config['debug'] = false;
  }
}

This code snippet demonstrates how to securely set the debug setting in a Java application using Separation of Privilege.

Node.js

const express = require('express');
const app = express();

app.use((req, res, next) => {
  if (req.query.debug === 'true') {
    config['debug'] = true;
  } else {
    config['debug'] = false;
  }
});

This code snippet demonstrates how to securely set the debug setting in a Node.js application using Separation of Privilege.

Python/Django

from django.conf import settings

def set_debug(debug):
  if debug:
    settings.DEBUG = True
  else:
    settings.DEBUG = False

This code snippet demonstrates how to securely set the debug setting in a Django application using Separation of Privilege.

How to Ask AI to Check Your Code for External Control of System or Configuration Setting

You can ask an AI coding assistant to review your code and identify potential vulnerabilities related to External Control of System or Configuration Setting (CWE-15).

External Control of System or Configuration Setting Best Practices Checklist

✅ Implement Separation of Privilege to prevent unauthorized access. ✅ Validate user input to prevent modification of configuration settings. ✅ Regularly update and patch the system to prevent exploitation.

External Control of System or Configuration Setting FAQ

How does External Control of System or Configuration Setting occur?

External Control of System or Configuration Setting occurs when one or more system settings or configuration elements can be externally controlled by a user, making it vulnerable to various attacks.

What is the primary prevention technique for External Control of System or Configuration Setting?

The primary prevention technique for External Control of System or Configuration Setting is Separation of Privilege.

How does External Control of System or Configuration Setting impact business operations?

External Control of System or Configuration Setting can lead to unauthorized access, data breaches, and system crashes, resulting in significant financial losses and reputational damage.

What are the common consequences of External Control of System or Configuration Setting?

The common consequences of External Control of System or Configuration Setting include unauthorized access, data breaches, system crashes, and loss of sensitive information.

How can I detect External Control of System or Configuration Setting in my application?

You can detect External Control of System or Configuration Setting by conducting regular security audits, using automated scanning tools, and implementing logging and monitoring mechanisms.

What are the best practices for preventing External Control of System or Configuration Setting?

The best practices for preventing External Control of System or Configuration Setting include implementing Separation of Privilege, validating user input, and regularly updating software and configurations.

Can AI assist in detecting and fixing External Control of System or Configuration Setting vulnerabilities?

Yes, AI can assist in detecting and fixing External Control of System or Configuration Setting vulnerabilities by analyzing code patterns, identifying potential weaknesses, and providing recommendations for remediation.

Vulnerabilities Related to External Control of System or Configuration Setting

References

• MITRE CWE-15
• OWASP A02:2025 - Security Misconfiguration
• CAPEC-13, CAPEC-146, CAPEC-176, CAPEC-203, CAPEC-270, CAPEC-271, CAPEC-579, CAPEC-69, CAPEC-76, CAPEC-77
• NVD CVE Database

Scan Your Own Site

Scan your website using PenScan to find External Control of System or Configuration Setting and other risks before an attacker does.