What is CWE-642: External Control of Critical State Data?+
CWE-642: External Control of Critical State Data is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors. If an attacker can modify the state information without detection, then it could be used to perform unauthorized actions or access unexpected resources, since the application programmer does not expect that the state can be changed. State information can be stored in various locations such as a cookie, in a hidden web form field, input parameter or argument, an environment variable, a database record, within a settings file, etc. All of these locations have the potential to be modified by an attacker. When this state information is used to control security or determine resource usage, then it may create a vulnerability. For example, an application may perform authentication, then save the state in an "authenticated=true" cookie. An attacker may simply create this cookie in order to bypass the authentication.
What are the security consequences of External Control of Critical State Data?+
If exploited, CWE-642 (External Control of Critical State Data) it can compromise Access Control, Confidentiality and Availability, leading to outcomes such as Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data and DoS: Crash, Exit, or Restart.
How do you prevent or mitigate External Control of Critical State Data?+
Recommended mitigations for CWE-642 include: Understand all the potential locations that are accessible to attackers. For example, some programmers assume that cookies and hidden form fields cannot be modified by an attacker, or they may not consider that environment variables can be modified before a privileged program is invoked. Store state information on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions.
How is External Control of Critical State Data detected?+
CWE-642 can be detected using Fuzzing and Manual Dynamic Analysis. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by External Control of Critical State Data?+
CWE-642 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of External Control of Critical State Data?+
MITRE documents real CVEs mapped to CWE-642, including CVE-2005-2428, CVE-2008-0306, CVE-1999-0073, CVE-2007-4432 and CVE-2006-7191. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-642 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.