CWE-913: Improper Control of Dynamically-Managed Code Resources

Description:
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Extended Description:
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.

Affected languages: Not Language-Specific, Interpreted
Parent weaknesses: CWE-664

Consequences:
  - Integrity: Execute Unauthorized Code or Commands
  - Other: Varies by Context

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand

Mitigations:
  - [Implementation] For any externally-influenced input, check the input against an allowlist of acceptable values.
  - [Implementation] Refactor the code so that it does not need to be dynamically managed.

Demonstrative examples:
This example attempts to write user messages to a message file and allow users to view them.
While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }
name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

A common reason that programmers use the
               reflection API is to implement their own command
               dispatcher. The following example shows a command
               dispatcher that does not use reflection:
A programmer might refactor this code to use reflection as follows:
String ctl = request.getParameter("ctl"); 
				  Worker ao = null; 
				  if (ctl.equals("Add")) {
				   
				  ao = new AddCommand();
				   
				  } 
				  else if (ctl.equals("Modify")) {
				   
				  ao = new ModifyCommand();
				   
				  } 
				  else {
				   
				  throw new UnknownActionError();
				   }
				   
				  ao.doAction(request);
String ctl = request.getParameter("ctl"); 
					Class cmdClass = Class.forName(ctl + "Command"); 
					Worker ao = (Worker) cmdClass.newInstance(); 
				

Real-world examples:
  - CVE-2022-2054: Python compiler uses eval() to execute malicious strings as Python code.
  - CVE-2[PII_REDACTED]: Cryptography API uses unsafe reflection when deserializing a private key
  - CVE-2015-8103: Deserialization issue in commonly-used Java library allows remote execution.
  - CVE-2006-7079: Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
  - CVE-2012-2055: Source version control product allows modification of trusted key using mass assignment.