CWE-471: Modification of Assumed-Immutable Data (MAID) | Glexia
CWE-471 (Modification of Assumed-Immutable Data (MAID)) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE ATT&CK context.
Glexia's Take · Automated analysis
CWE-471: Modification of Assumed-Immutable Data (MAID)
Modification of Assumed-Immutable Data (MAID) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Integrity: Modify Application Data: Common data types that are attacked are environment variables, web application parameters, and HTTP headers.
- Integrity: Unexpected State
Developer Pattern
CWE-471 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-471, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- In the code excerpt below, an array returned by a Java method is modified despite the fact that arrays are mutable.
Remediation
- Architecture and Design Operation Implementation: When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
- CWE-1282: Assumed-Immutable Data is Stored in Writable Memory
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-425: Direct Request ('Forced Browsing')
- CWE-664: Improper Control of a Resource Through its Lifetime
- CWE-472: External Control of Assumed-Immutable Web Parameter
- CWE-473: PHP External Variable Modification
- CWE-602: Client-Side Enforcement of Server-Side Security
- CWE-607: Public Static Final Field References Mutable Object
- CWE-621: Variable Extraction Error
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.