CWE-665: Improper Initialization

Description:
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Extended Description:
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-664

Consequences:
  - Confidentiality: Read Memory
  - Access Control: Bypass Protection Mechanism
  - Availability: DoS: Crash, Exit, or Restart

Detection methods:
  - Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, a
  - Manual Dynamic Analysis: Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, 
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local)
  - [Architecture and Design] Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
  - [Implementation] Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
  - [Implementation] Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.

Demonstrative examples:
Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached.

private boolean initialized = true; public void someMethod() { 
                         if (!initialized) { 
                               
                                  
                                  // perform initialization tasks 
                                  ... 
                                  initialized = true; 
                            }

The following code intends to limit certain operations to the administrator only.
If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident.
$username = GetCurrentUser(); $state = GetStateData($username); if (defined($state)) { $uid = ExtractUserID($state); } 
                      
                      # do stuff 
                      if ($uid == 0) { DoAdminThings(); }

Real-world examples:
  - CVE-2001-1471: chain: an invalid value prevents a library file from being included, skipping initialization of key variables, leading to resultant eval injection.
  - CVE-2008-3637: Improper error checking in protection mechanism produces an uninitialized variable, allowing security bypass and code execution.
  - CVE-2008-4197: Use of uninitialized memory may allow code execution.
  - CVE-2008-2934: Free of an uninitialized pointer leads to crash and possible code execution.
  - CVE-2007-3749: OS kernel does not reset a port when starting a setuid program, allowing local users to access the port and gain privileges.