CWE-670: Always-Incorrect Control Flow Implementation

CWE-670: Always-Incorrect Control Flow Implementation | RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

This code queries a server and displays its status when a request comes from an authorized IP address.

Vulnerable example

php

...
$requestingIP = $_SERVER['REMOTE_ADDR'];

This code redirects unauthorized users, but continues to execute code after calling http_redirect(). This means even unauthorized users may be able to access the contents of the page or perform a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address spoofing attack (CWE-212).

In this example, the programmer has indented the statements to call Do_X() and Do_Y(), as if the intention is that these functions are only called when the condition is true. However, because there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.

Vulnerable example

if (condition==true)

This might not be what the programmer intended. When the condition is critical for security, such as in making a security decision or detecting a critical error, this may produce a vulnerability.

In both of these examples, a message is printed based on the month passed into the function:

Vulnerable example

java

public void printMessage(int month){

Vulnerable example

void printMessage(int month){

Both examples do not use a break statement after each case, which leads to unintended fall-through behavior. For example, calling "printMessage(10)" will result in the text "OctoberNovemberDecember is a great month" being printed.

In the excerpt below, an AssertionError (an unchecked exception) is thrown if the user hasn't entered an email address in an HTML form.

Vulnerable example

java

String email = request.getParameter("email_address");

CWE-670: Always-Incorrect Control Flow Implementation

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Code examples

Illustrative examples

Frequently asked questions

What is CWE-670?

What CVEs are caused by CWE-670?

What are the consequences of CWE-670?

Is CWE-670 actively exploited?

References

Stay ahead of CWE-670

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Frequently asked questions

What is CWE-670?

What CVEs are caused by CWE-670?

What are the consequences of CWE-670?

Is CWE-670 actively exploited?

References

Stay ahead of CWE-670