2264
netmasks, or causing apparently-symbolic identifiers to be processed as if they are numbers. In
web applications, this can enable bypassing of SSRF restrictions.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 704 Incorrect Type Conversion or Cast 1538
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 189 Numeric Errors 2312
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
An attacker may use an unexpected numerical base to
access private application resources.
Unknown
Integrity Bypass Protection Mechanism
Alter Execution Logic
An attacker may use an unexpected numerical base to
bypass or manipulate access control mechanisms.
Unknown
Potential Mitigations
Phase: Implementation
Strategy = Enforcement by Conversion
If only decimal-based values are expected in the application, conditional checks should be
created in a way that prevent octal or hexadecimal strings from being checked. This can be
achieved by converting any numerical string to an explicit base-10 integer prior to the conditional
check, to prevent octal or hex values from ever being checked against the condition.
Phase: Implementation
Strategy = Input Validation
If various numerical bases do need to be supported, check for leading values indicating the
non-decimal base you wish to support (such as 0x for hex) and convert the numeric strings to
integers of the respective base. Reject any other alternative-base string that is not intentionally
supported by the application.
Phase: Implementation
Strategy = Input Validation
If regular expressions are used to validate IP addresses, ensure that they are bounded using ^
and $ to prevent base-prepended IP addresses from being matched.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-1389: Incorrect Parsing of Numbers with Different Radices
CWE-1389: Incorrect Parsing of Numbers with Different Radices