1534
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 670 Always-Incorrect Control Flow Implementation 1475
ChildOf 705 Incorrect Control Flow Scoping 1542
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 438 Behavioral Problems 2326
Weakness Ordinalities
Primary :
Alternate Terms
Redirect Without Exit :
Common Consequences
Scope Impact Likelihood
Other
Confidentiality
Integrity
Availability
Alter Execution Logic
Execute Unauthorized Code or Commands
This weakness could affect the control flow of the
application and allow execution of untrusted code.
Detection Methods
Black Box
This issue might not be detected if testing is performed using a web browser, because the
browser might obey the redirect and move the user to a different page before the application has
produced outputs that indicate something is amiss.
Demonstrative Examples
Example 1:
This code queries a server and displays its status when a request comes from an authorized IP
address.
Example Language: PHP (Bad)
$requestingIP = $_SERVER['REMOTE_ADDR'];
if(!in_array($requestingIP,$ipAllowList)){
echo "You are not authorized to view this page";
http_redirect($errorPageURL);
}
$status = getServerStatus();
echo $status;
...
This code redirects unauthorized users, but continues to execute code after calling http_redirect().
This means even unauthorized users may be able to access the contents of the page or perform
a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address
spoofing attack (CWE-212).
Observed Examples
CWE Version 4.14
CWE-703: Improper Check or Handling of Exceptional Conditions
CWE-703: Improper Check or Handling of Exceptional Conditions