CWE-471 (对假设不可变数据的修改(MAID)) — Vulnerability Class 37

CWE-471 represents a critical integrity weakness where an application fails to protect data elements it incorrectly assumes are immutable. This vulnerability typically arises when developers treat sensitive inputs, such as hidden form fields, cookies, or reverse DNS lookups, as read-only configuration values rather than untrusted user data. Attackers exploit this flaw by manipulating these assumed-fixed values to bypass security controls, escalate privileges, or alter application logic. For instance, modifying a hidden field to change a user’s role can grant unauthorized access. To mitigate this risk, developers must strictly validate and sanitize all user-supplied inputs, regardless of their source or apparent immutability. Implementing server-side integrity checks and avoiding reliance on client-side constraints ensures that critical data remains protected from unauthorized modification, thereby maintaining the application’s security posture.