Since this weakness does not typically appear frequently within a single software package, manual white box techniques may be able to provide sufficient code coverage and reduction of false positives if all potentially-vulnerable operations can be assessed within limited time constraints.
CWE-807 Base Incomplete
Reliance on Untrusted Inputs in a Security Decision
This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates.
Definition
What is CWE-807?
This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates.
Developers often mistakenly trust inputs like cookies, hidden form fields, or environment variables, assuming they can't be altered by users. However, attackers can modify these values using proxy tools, crafted requests, or client-side tampering. When your code uses these tainted inputs to make critical security decisions—like checking if a user is an admin—the entire security model can be circumvented if the input isn't properly validated and secured.
Any data originating from outside your trusted boundary should be considered potentially malicious. Without strong integrity checks, encryption, or server-side validation, you cannot rely on it for security decisions. Managing this at scale is difficult; an ASPM like Plexicus can help you track and remediate these trust-boundary flaws across your entire application stack, using AI to prioritize risks and suggest specific fixes.
Real-world impact
Real-world CVEs caused by CWE-807
-
Attacker can bypass authentication by setting a cookie to a specific value.
-
Attacker can bypass authentication and gain admin privileges by setting an "admin" cookie to 1.
-
Content management system allows admin privileges by setting a "login" cookie to "OK."
-
e-dating application allows admin privileges by setting the admin cookie to 1.
-
Web-based email list manager allows attackers to gain admin privileges by setting a login cookie to "admin."
How attackers exploit it
Step-by-step attacker path
- 1
The following code excerpt reads a value from a browser cookie to determine the role of the user.
- 2
The following code could be for a medical records application. It performs authentication by checking if a cookie has been set.
- 3
The programmer expects that the AuthenticateUser() check will always be applied, and the "authenticated" cookie will only be set when authentication succeeds. The programmer even diligently specifies a 2-hour expiration for the cookie.
- 4
However, the attacker can set the "authenticated" cookie to a non-zero value such as 1. As a result, the $auth variable is 1, and the AuthenticateUser() check is not even performed. The attacker has bypassed the authentication.
- 5
In the following example, an authentication flag is read from a browser cookie, thus allowing for external control of user state data.
Vulnerable code example
Vulnerable Java
The following code excerpt reads a value from a browser cookie to determine the role of the user.
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("role")) {
userRole = c.getValue();
}
} Secure code example
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist
How to prevent CWE-807
- Architecture and Design Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
- Architecture and Design Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.
- Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Operation / Implementation When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
- Architecture and Design / Implementation Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls. Identify all inputs that are used for security decisions and determine if you can modify the design so that you do not have to rely on submitted inputs at all. For example, you may be able to keep critical information about the user's session on the server side instead of recording it within external data.
Detection signals
How to detect CWE-807
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Web Application Scanner Web Services Scanner Database Scanners
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Fuzz Tester Framework-based Fuzzer Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Manual Source Code Review (not inspections)
Plexicus auto-detects CWE-807 and opens a fix PR in under 60 seconds.
Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.
Frequently asked questions What is CWE-807?
How serious is CWE-807?
What languages or platforms are affected by CWE-807?
How can I prevent CWE-807?
How does Plexicus detect and fix CWE-807?
Where can I learn more about CWE-807?
Frequently asked questions
What is CWE-807?
This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates.
How serious is CWE-807?
MITRE rates the likelihood of exploit as High — this weakness is actively exploited in the wild and should be prioritized for remediation.
What languages or platforms are affected by CWE-807?
MITRE has not specified affected platforms for this CWE — it can apply across most application stacks.
How can I prevent CWE-807?
Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on…
How does Plexicus detect and fix CWE-807?
Plexicus's SAST engine matches the data-flow signature for CWE-807 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-807?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/807.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Related weaknesses
Weaknesses related to CWE-807
CWE-693 Parent
Protection Mechanism Failure
This weakness occurs when software either lacks a necessary security control, implements one that is too weak, or fails to activate an…
CWE-1039 Sibling
Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
This vulnerability occurs when a system uses automated AI or machine learning to classify complex inputs like images, audio, or text, but…
CWE-1248 Sibling
Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
A security-critical hardware component contains physical flaws in its semiconductor material, which can cause it to malfunction and…
CWE-1253 Sibling
Incorrect Selection of Fuse Values
This vulnerability occurs when a hardware security fuse is incorrectly programmed to represent a 'secure' state as logic 0 (unblown). An…
CWE-1269 Sibling
Product Released in Non-Release Configuration
This vulnerability occurs when a product ships to customers while still configured with its pre-production or manufacturing settings,…
CWE-1278 Sibling
Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
This vulnerability occurs when hardware lacks safeguards against physical inspection, allowing attackers to extract sensitive data by…
CWE-1291 Sibling
Public Key Re-Use for Signing both Debug and Production Code
This vulnerability occurs when the same cryptographic key is used to sign both development/debug software builds and final production…
CWE-1318 Sibling
Missing Support for Security Features in On-chip Fabrics or Buses
This vulnerability occurs when the communication channels (fabrics or buses) within a chip lack built-in or enabled security features,…
CWE-1319 Sibling
Improper Protection against Electromagnetic Fault Injection (EM-FI)
This vulnerability occurs when a hardware device lacks sufficient shielding against electromagnetic interference, allowing attackers to…
Resources
Further reading
- MITRE — official CWE-807 https://cwe.mitre.org/data/definitions/807.html
- Top 25 Series - Rank 6 - Reliance on Untrusted Inputs in a Security Decision https://www.sans.org/blog/top-25-series-rank-6-reliance-on-untrusted-inputs-in-a-security-decision/
- HMAC https://en.wikipedia.org/wiki/HMAC
- Understanding ASP.NET View State https://learn.microsoft.com/en-us/previous-versions/dotnet/articles/ms972976(v=msdn.10)?redirectedfrom=MSDN
- OWASP Enterprise Security API (ESAPI) Project https://owasp.org/www-project-enterprise-security-api/
- State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
Ready when you are
Don't Let Security
Weigh You Down.
Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.