CWE-1106: Insufficient Use of Symbolic Constants

What is Insufficient Use of Symbolic Constants?

• Overview: Insufficient Use of Symbolic Constants refers to the practice of using literal values (like numbers or strings) directly in the code instead of defining and using symbolic constants, which can make the code harder to maintain and more prone to errors.

• Exploitation Methods:

• Attackers can exploit this vulnerability by identifying and targeting hard-coded values that may represent security-related configuration, making it easier to manipulate or predict behavior.
• Common attack patterns include code injection or alteration, where attackers modify literal values to alter the program’s control flow or logic.

• Security Impact:

• Direct consequences of successful exploitation can include unauthorized access, data manipulation, or execution of arbitrary code.
• Potential cascading effects include increased difficulty in patching vulnerabilities due to scattered literal values throughout the code.
• Business impact may involve increased maintenance costs, reduced agility in responding to security threats, and potential downtime or data breaches.

• Prevention Guidelines:

• Specific code-level fixes involve replacing literal constants with symbolic constants or enumerations, which are defined in a central location.
• Security best practices include regular code reviews and refactoring to ensure consistent use of symbolic constants and adherence to coding standards.
• Recommended tools and frameworks include static analysis tools to detect literal values and refactoring tools to assist in the replacement of literals with symbolic constants.

Corgea can automatically detect and fix Insufficient Use of Symbolic Constants in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not specified

Affected Technologies: Not specified