External Control of System or Configuration Setting

Description

Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways. An attacker could cause an error by providing a nonexistent catalog name or connect to an unauthorized portion of the database.

Examples

Insecure Code

$TAINTED = ($REQ: HttpServletRequest).getParameter(...);
...
($CONN: java.sql.Connection).setCatalog($TAINTED);

Secure Code

$validatedInput = validateUserInput($REQ.getParameter(...));
...
($CONN: java.sql.Connection).setCatalog($validatedInput);

Remediation

Validate and sanitize user input before using it to set system settings, such as database catalog names.

Rule Details

Field	Value
ID	CODE-0075
Category	InsecureConfig
Severity	HIGH
CWE	CWE-15
Confidence	HIGH
Impact	HIGH
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	external control, system settings, database security
OWASP	N/A

---