logo

Initialization of a Resource with an Insecure Default

Incomplete Base
Structure: Simple
Description

This vulnerability occurs when software uses an insecure default setting or value for a resource, assuming an administrator will change it later.

Extended Description

Developers often set open, permissive defaults to make a product easy to install and use right away. The security model relies entirely on the administrator remembering to change these defaults to a more secure configuration, which is a risky assumption. This creates an 'out-of-the-box' vulnerability where the system is insecure from the moment it's installed. The resulting security gap remains until an admin takes action, leaving a window of exposure that attackers can easily discover and exploit.
Demonstrative Examples 1

ID : DX-163

This code attempts to login a user using credentials from a POST request:

Code Example:

Bad
PHP


// $user and $pass automatically set from POST request*
if (login_user($user,$pass)) {
```
$authorized = true;
}


php
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any value included in the POST request if register_globals is enabled. An attacker can send a POST request with an unexpected third value 'authorized' set to 'true' and gain authorized status without supplying valid credentials.
Here is a fixed version:
Code Example:
Good
PHP
php


...*
This code avoids the issue by initializing the $authorized variable to false and explicitly retrieving the login credentials from the $_POST variable. Regardless, register_globals should never be enabled and is disabled by default in current versions of PHP.
  
Observed Examples 2
CVE-2022-36349insecure default variable initialization in BIOS firmware for a hardware board allows DoS
CVE-2022-42467A generic database browser interface has a default mode that exposes a web server to the network, allowing queries to the database.
   
  
        
Related Attack Patterns 
        
 
 
Related Weaknesses 
 
 
 
 
  ChildOf:
 Incorrect Initialization of Resource (CWE-1419) 
  ChildOf:
 Improper Initialization (CWE-665) 
 
 
 
   
Notes 
MaintenanceThis entry improves organization of concepts under initialization. The typical CWE model is to cover "Missing" and "Incorrect" behaviors. Arguably, this entry could be named as "Incorrect" instead of "Insecure." This might be changed in the near future.