CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
How it's found
Improper Control of Dynamically-Managed Code Resources describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
Vulnerable vs. safe
String ctl = request.getParameter("ctl");Class cmdClass = Class.forName(ctl + "Command");Worker ao = (Worker) cmdClass.newInstance();ao.doAction(request);ao = new AddCommand();
ao = new ModifyCommand();
throw new UnknownActionError();String ctl = request.getParameter("ctl");Worker ao = null;if (ctl.equals("Add")) {}else if (ctl.equals("Modify")) {}else {}ao.doAction(request);Consequences
- Execute Unauthorized Code or Commands
- Varies by Context, Alter Execution Logic
Mitigations
- Implementation: For any externally-influenced input, check the input against an allowlist of acceptable values.
- Implementation/Architecture and Design: Refactor the code so that it does not need to be dynamically managed.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-913?
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
How do you find Improper Control of Dynamically-Managed Code Resources?
Improper Control of Dynamically-Managed Code Resources describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-913?
Execute Unauthorized Code or Commands Varies by Context, Alter Execution Logic
Does TurboPentest test for Improper Control of Dynamically-Managed Code Resources?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest