Modification of Assumed-Immutable Data (MAID)
Weakness ID: 471 (Weakness Base)Status: Draft
+ Description

Description Summary

The software does not properly protect an assumed-immutable element from being modified by an attacker.
+ Time of Introduction
  • Implementation
+ Applicable Platforms



+ Demonstrative Examples

Example 1

In the code excerpt below, an array returned by a Java method is modified despite the fact that arrays are mutable.

(Bad Code)
Example Language: Java 
String[] colors = car.getAllPossibleColors();
colors[0] = "Red";
+ Observed Examples
CVE-2002-1757Relies on $PHP SELF variable for authentication.
CVE-2005-1905Gain privileges by modifying assumed-immutable code addresses that are accessed by a driver.
+ Potential Mitigations

Phases: Architecture and Design; Operation; Implementation

Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)

+ Other Notes

Factors: MAID issues can be primary to many other weaknesses, and they are a major factor in languages such as PHP.

This happens when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. A common programmer assumption is that certain variables are immutable; especially consider hidden form fields in web applications. So there are many examples where the MUTABILITY property is a major factor in a vulnerability.

Common data types that are attacked are environment variables, web application parameters, and HTTP headers.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory19Data Handling
Development Concepts (primary)699
ChildOfWeakness ClassWeakness Class664Improper Control of a Resource Through its Lifetime
Research Concepts (primary)1000
RequiredByCompound Element: CompositeCompound Element: Composite291Trusting Self-reported IP Address
Research Concepts1000
RequiredByCompound Element: CompositeCompound Element: Composite426Untrusted Search Path
Research Concepts1000
ParentOfWeakness BaseWeakness Base472External Control of Assumed-Immutable Web Parameter
Development Concepts (primary)699
Research Concepts1000
ParentOfWeakness VariantWeakness Variant473PHP External Variable Modification
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness Variant607Public Static Final Field References Mutable Object
Development Concepts699
Research Concepts (primary)1000
CanFollowWeakness BaseWeakness Base425Direct Request ('Forced Browsing')
Research Concepts1000
CanFollowWeakness BaseWeakness Base602Client-Side Enforcement of Server-Side Security
Research Concepts1000
PeerOfWeakness BaseWeakness Base621Variable Extraction Error
Research Concepts1000
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERModification of Assumed-Immutable Data
+ Content History
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modification DateModifierOrganizationSource
2008-07-01Sean EidemillerCigitalExternal
added/updated demonstrative examples
2008-07-01Eric DalciCigitalExternal
updated Potential Mitigations, Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Other Notes, Taxonomy Mappings
2009-07-27CWE Content TeamMITREInternal
updated Other Notes