CWE-472 External Control of Assumed-Immutable Data

Coverage: 6 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 6 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged a pattern where the code assumes some value cannot be changed (immutable), but it is actually controlled externally (client input, request headers, environment, query params, cached objects that can be mutated).

Why it matters

Assumptions about immutability can be violated and exploited.

• Security bypass when "trusted" values can be changed (e.g., isAdmin, plan, price, userId).
• Race/consistency bugs where state changes after checks (see CWE-362).

Safer examples

1) Treat client-controlled data as mutable and untrusted

Re-validate sensitive values at the point of use, not only at parse time.

2) Copy/normalize values you rely on

Don't keep references to mutable objects you don't control; copy required fields into a validated structure.

3) Use server-side source of truth

Look up roles, plans, prices, and permissions from the server/database, not from client payloads.

How SiteShadow detects it (high level)

• Detects security decisions made using values that originate from untrusted/mutable sources.
• Flags patterns where values are assumed constant across a request but can be influenced externally.

References

• CWE-472: https://cwe.mitre.org/data/definitions/472.html

---

← Back to Vulnerability Library