CWE-344: Use of Invariant Value in Dynamically Changing Context

Causes

• The following code is an example of an internal hard-coded password in the back-end: Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."
• This code assumes a particular function will always be found at a particular address. It assigns a pointer to that address and calls the function. The same function may not always be found at the same memory address. This could lead to a crash, or an attacker may alter the memory at the expected address, leading to arbitrary code execution.

Remediation

• Use safe APIs
• Centralize the control
• Add regression tests
• Review logs and telemetry for attempted abuse

Detection

• Code review
• SAST
• DAST
• Focused regression tests

Related CWEs

• CWE-1188: Initialization of a Resource with an Insecure Default
• CWE-323: Reusing a Nonce, Key Pair in Encryption
• CWE-330: Use of Insufficiently Random Values
• CWE-587: Assignment of a Fixed Address to a Pointer
• CWE-798: Use of Hard-coded Credentials

Related CVEs

Related CVE mappings appear after CVE records are cross-indexed.

ATT&CK Relevance

ATT&CK relevance is shown only when reviewed or responsibly inferred.