CWE-472 External Control of Assumed-Immutable Data
What this means
SiteShadow flagged a pattern where the code assumes some value cannot be changed (immutable), but it is actually controlled externally (client input, request headers, environment, query params, cached objects that can be mutated).
Why it matters
Assumptions about immutability can be violated and exploited.
- Security bypass when "trusted" values can be changed (e.g.,
isAdmin,plan,price,userId). - Race/consistency bugs where state changes after checks (see
CWE-362).
Safer examples
1) Treat client-controlled data as mutable and untrusted
Re-validate sensitive values at the point of use, not only at parse time.
2) Copy/normalize values you rely on
Don't keep references to mutable objects you don't control; copy required fields into a validated structure.
3) Use server-side source of truth
Look up roles, plans, prices, and permissions from the server/database, not from client payloads.
How SiteShadow detects it (high level)
- Detects security decisions made using values that originate from untrusted/mutable sources.
- Flags patterns where values are assumed constant across a request but can be influenced externally.
References
- CWE-472: https://cwe.mitre.org/data/definitions/472.html
---