Live Active security incident? Get immediate response
CWE Reference

CWE-914: Improper Control of Dynamically-Identified Variables

Official CWE-914 CWE context with Glexia analysis, remediation guidance, related CVEs, and ATT&CK context.

Release 4.20weaknessIncomplete
Search CWE CWE Dictionary

Glexia's Take

CWE-914: Improper Control of Dynamically-Identified Variables

Improper Control of Dynamically-Identified Variables represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Executive Impact

  • Integrity: Modify Application Data: An attacker could modify sensitive data or program variables.
  • Integrity: Execute Unauthorized Code or Commands
  • Other,Integrity: Varies by Context,Alter Execution Logic

Developer Pattern

CWE-914 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.

Confidence

high confidence from CWE-914, 4.20.

Official CWE Definition

CWE-914: Improper Control of Dynamically-Identified Variables

The product does not properly restrict reading from or writing to dynamically-identified variables.

Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.

Type
weakness
Abstraction
Base
Status
Incomplete
Source
MITRE CWE definition

Developer And Remediation Guidance

How teams prevent and detect this weakness

Causes

  • This code uses the credentials sent in a POST request to login a user. The call to extract() will overwrite the existing values of any variables defined previously, in this case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin" equal to "true", thus gaining Admin privileges.

Remediation

  • Implementation: For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
  • Implementation,Architecture and Design: Refactor the code so that internal program variables do not need to be dynamically identified.

Detection

  • Code review
  • SAST
  • DAST
  • Focused regression tests

Mappings

Related CVEs, CWEs, and ATT&CK context

Related CWEs

Related CVEs

Related CVE mappings appear after CVE records are cross-indexed.

Open CWE CVE mapping

ATT&CK Relevance

ATT&CK relevance is shown only when reviewed or responsibly inferred.