What is Variable Extraction Error (CWE-621)?

TL;DR: Variable Extraction Error (CWE-621) is a security vulnerability that allows attackers to overwrite sensitive variables through unverified input. Ensure your application uses validated variable names and refactors risky extraction patterns.

What is Variable Extraction Error?

Variable Extraction Error (CWE-621) is a type of input validation vulnerability where external input determines the names of variables to extract without verifying their validity. As defined by the MITRE Corporation under CWE-621, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Variable Extraction Error occurs when an application uses unverified user input to determine variable names for extraction processes. This can lead to unintended modifications of sensitive data or program variables. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Variable Extraction Error Overview · How Variable Extraction Error Works · Business Impact of Variable Extraction Error · Variable Extraction Error Attack Scenario · How to Detect Variable Extraction Error · How to Fix Variable Extraction Error · Framework-Specific Fixes for Variable Extraction Error · How to Ask AI to Check Your Code for Variable Extraction Error · Variable Extraction Error Best Practices Checklist · Variable Extraction Error FAQ · Vulnerabilities Related to Variable Extraction Error · References · Scan Your Own Site

Variable Extraction Error Overview

What

Variable Extraction Error occurs when a product uses external input to determine variable names for extraction without validating them.

Why it matters

This vulnerability can lead to unauthorized modifications of sensitive data or program variables, compromising the integrity and security of an application.

Where it occurs

It commonly affects applications using PHP’s extract() function with user-provided input.

Who is affected

Developers and organizations relying on PHP for dynamic variable extraction are at risk.

Who is NOT affected

Applications that avoid dynamic variable extraction or use secure validation mechanisms are not vulnerable to this issue.

How Variable Extraction Error Works

Root Cause

The root cause lies in the lack of validation when using external input to determine variable names, leading to potential overwrites of unintended variables.

Attack Flow

1. An attacker injects malicious input into a parameter that controls variable extraction.
2. The application extracts variables based on this unverified input without proper checks.
3. Sensitive data or program variables are overwritten with potentially harmful values.

Prerequisites to Exploit

• External input must influence the names of extracted variables.
• No validation mechanisms are in place to restrict or verify these inputs.

Vulnerable Code

$input = $_GET['data'];
extract($input);

This code allows an attacker to inject malicious variable names via $_GET['data'], leading to unintended overwrites.

Secure Code

$allowedVariables = ['safeVar1', 'safeVar2'];
foreach ($allowedVariables as $var) {
    if (isset($_GET[$var])) {
        $$var = $_GET[$var];
    }
}

This code ensures that only predefined and safe variable names are extracted, preventing unauthorized modifications.

Business Impact of Variable Extraction Error

Integrity

• Data modification: Attackers can overwrite sensitive data or program variables.
• Application state manipulation: Unauthorized changes to application logic through variable overwrites.

Availability

• Potential system instability due to unintended variable overwrites affecting critical operations.

Financial, Compliance, Reputation

• Data breaches leading to financial losses and legal liabilities.
• Non-compliance with security standards and regulations.
• Damage to brand reputation from publicized data integrity issues.

Variable Extraction Error Attack Scenario

1. An attacker injects malicious input into a parameter controlling variable extraction.
2. The application extracts variables based on this unverified input without proper checks.
3. Sensitive data or program variables are overwritten with potentially harmful values, leading to unauthorized access and modifications.
4. The attacker exploits the modified state to gain further control over the system.

How to Detect Variable Extraction Error

Manual Testing

• [ ] Review code for use of extract() or similar functions with unverified input.
• [ ] Ensure that variable names are validated against a predefined list before extraction.
• [ ] Test edge cases where malicious inputs could influence variable names.

Automated Scanners (SAST / DAST)

Static analysis can detect direct calls to risky functions like extract(). Dynamic testing is needed to validate input handling in runtime scenarios.

PenScan Detection

PenScan’s engines such as ZAP and Wapiti flag suspicious use of dynamic variable extraction routines.

False Positive Guidance

False positives occur when valid, safe uses of extract() are flagged. Ensure that only unverified inputs are scrutinized.

How to Fix Variable Extraction Error

• Use allowlists: Define a list of allowed variables before extraction.
• Refactor code: Avoid dynamic variable extraction routines altogether.
• PHP-specific options: Use EXTR_SKIP and EXTR_PREFIX_ALL with extract().
• Validate input: Ensure external inputs are properly sanitized and validated.

Framework-Specific Fixes for Variable Extraction Error

PHP

$allowedVariables = ['safeVar1', 'safeVar2'];
foreach ($allowedVariables as $var) {
    if (isset($_GET[$var])) {
        $$var = $_GET[$var];
    }
}

This ensures only predefined and safe variable names are extracted, preventing unauthorized modifications.

How to Ask AI to Check Your Code for Variable Extraction Error

Variable Extraction Error Best Practices Checklist

• ✅ Define a list of allowed variables before extraction.
• ✅ Refactor code to avoid dynamic variable extraction routines.
• ✅ Use PHP-specific options like EXTR_SKIP and EXTR_PREFIX_ALL.
• ✅ Validate external inputs thoroughly before use.
• ✅ Test edge cases where malicious inputs could influence variable names.

Variable Extraction Error FAQ

How does Variable Extraction Error occur?

It occurs when a product uses external input to extract variables without verifying their validity, potentially overwriting unintended variables.

What are the real-world impacts of Variable Extraction Error?

Attackers can modify sensitive data or program variables, leading to unauthorized access and data integrity issues.

How does PHP handle variable extraction safely?

In PHP, use extract() with options like EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument for added security.

What are the common consequences of Variable Extraction Error?

It can lead to data modification, unauthorized access, and potential system instability due to unintended variable overwrites.

How do attackers exploit Variable Extraction Error?

Attackers inject malicious input to overwrite sensitive variables or modify application state, compromising security.

What are the best practices for detecting Variable Extraction Error?

Use static code analysis tools and manual testing techniques like fuzzing and code reviews to identify potential issues.

Vulnerabilities Related to Variable Extraction Error

References

• MITRE - CWE-621
• NVD - NIST

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Variable Extraction Error and other risks before an attacker does.