CWE-673 (范围定义的外部影响) — Vulnerability Class 1

CWE-673 represents a design flaw where a software system fails to restrict the definition of its control sphere to internal or trusted administrative sources, allowing external actors to manipulate security boundaries. This weakness is typically exploited when attackers inject malicious parameters or modify configuration files to expand access privileges, bypass authentication mechanisms, or alter operational logic, effectively shifting the system’s trust model to favor the attacker. Developers prevent this by implementing strict input validation, ensuring that critical security configurations are immutable or signed by trusted authorities, and enforcing the principle of least privilege. By hardening the system against unauthorized modifications to its operational scope, organizations maintain the integrity of their security architecture and prevent adversaries from redefining the rules of engagement within the application environment.