Executar análise estática (SAST) na base de código à procura do padrão inseguro no fluxo de dados.
CWE-1188 Base Incompleto
Initialization of a Resource with an Insecure Default
This vulnerability occurs when software uses an insecure default setting or value for a resource, assuming an administrator will change it later.
Definição
What is CWE-1188?
This vulnerability occurs when software uses an insecure default setting or value for a resource, assuming an administrator will change it later.
Developers often set open, permissive defaults to make a product easy to install and use right away. The security model relies entirely on the administrator remembering to change these defaults to a more secure configuration, which is a risky assumption.
This creates an 'out-of-the-box' vulnerability where the system is insecure from the moment it's installed. The resulting security gap remains until an admin takes action, leaving a window of exposure that attackers can easily discover and exploit.
Impacto no mundo real
Real-world CVEs caused by CWE-1188
-
insecure default variable initialization in BIOS firmware for a hardware board allows DoS
-
A generic database browser interface has a default mode that exposes a web server to the network, allowing queries to the database.
Como os atacantes a exploram
Trajeto do atacante passo a passo
- 1
This code attempts to login a user using credentials from a POST request:
- 2
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any value included in the POST request if register_globals is enabled. An attacker can send a POST request with an unexpected third value 'authorized' set to 'true' and gain authorized status without supplying valid credentials.
- 3
Here is a fixed version:
- 4
This code avoids the issue by initializing the $authorized variable to false and explicitly retrieving the login credentials from the $_POST variable. Regardless, register_globals should never be enabled and is disabled by default in current versions of PHP.
Exemplo de código vulnerável
Vulnerable PHP
This code attempts to login a user using credentials from a POST request:
```
// $user and $pass automatically set from POST request*
if (login_user($user,$pass)) {
```
$authorized = true;
}
```
...*
if ($authorized) {
```
generatePage();
} Exemplo de código seguro
Secure PHP
Here is a fixed version:
$user = $_POST['user'];
$pass = $_POST['pass'];
$authorized = false;
if (login_user($user,$pass)) {
$authorized = true;
}
```
...* What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção
How to prevent CWE-1188
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Sinais de deteção
How to detect CWE-1188
Executar testes dinâmicos de segurança de aplicações (DAST) contra o endpoint em execução.
Monitorizar os registos em tempo de execução para traços de exceção invulgares, input malformado ou tentativas de contornar a autorização.
Revisão de código: sinalizar qualquer novo código que trate input desta superfície sem usar os ajudantes validados do framework.
CWE-1188
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Perguntas frequentes O que é o CWE-1188?
Qual a gravidade do CWE-1188?
Que linguagens ou plataformas são afetadas pelo CWE-1188?
Como posso prevenir o CWE-1188?
Como é que o Plexicus deteta e corrige o CWE-1188?
Onde posso saber mais sobre o CWE-1188?
Frequently asked questions
O que é o CWE-1188?
This vulnerability occurs when software uses an insecure default setting or value for a resource, assuming an administrator will change it later.
Qual a gravidade do CWE-1188?
A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.
Que linguagens ou plataformas são afetadas pelo CWE-1188?
A MITRE não especificou as plataformas afetadas por este CWE — pode aplicar-se à maioria das stacks de aplicações.
Como posso prevenir o CWE-1188?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
Como é que o Plexicus deteta e corrige o CWE-1188?
O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-1188 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.
Onde posso saber mais sobre o CWE-1188?
A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/1188.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.
Fraquezas relacionadas
Weaknesses related to CWE-1188
CWE-1419 Pai
Incorrect Initialization of Resource
This weakness occurs when a system fails to properly set up a resource during its creation, leaving it in an unstable, incorrect, or…
CWE-1051 Irmão
Initialization with Hard-Coded Network Resource Configuration Data
This vulnerability occurs when software uses fixed, hard-coded values—like IP addresses, domain names, or URLs—to identify network…
CWE-1052 Irmão
Excessive Use of Hard-Coded Literals in Initialization
This weakness occurs when software initializes variables or data structures using hard-coded values (like strings, file paths, or network…
CWE-1221 Irmão
Incorrect Register Defaults or Module Parameters
This vulnerability occurs when hardware description language (HDL) code sets insecure default values for hardware registers or…
CWE-454 Irmão
External Initialization of Trusted Variables or Data Stores
This vulnerability occurs when an application sets up its critical internal variables or storage systems using data from untrusted,…
CWE-453 Filho
Insecure Default Variable Initialization
This vulnerability occurs when software sets an internal variable to an insecure or unnecessarily weak default value during…
Pronto para validar o que importa?
Pronto para validar o que importa.
O Plexicus é Proof-Driven AppSec: achados validados, compreensão contextual e remediação revisada — ancorada em evidência, escopada com você.