1773
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1018 Manage User Sessions 2432
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1217 User Session Errors 2479
MemberOf 438 Behavioral Problems 2326
MemberOf 840 Business Logic Errors 2360
Common Consequences
Scope Impact Likelihood
Other Alter Execution Logic
An attacker could cause the product to skip critical
steps or perform them in the wrong order, bypassing its
intended business logic. This can sometimes have security
implications.
Demonstrative Examples
Example 1:
This code is part of an FTP server and deals with various commands that could be sent by a
user. It is intended that a user must successfully login before performing any other action such as
retrieving or listing files.
Example Language: Python (Bad)
def dispatchCommand(command, user, args):
if command == 'Login':
loginUser(args)
return
# user has requested a file
if command == 'Retrieve_file':
if authenticated(user) and ownsFile(user,args):
sendFile(args)
return
if command == 'List_files':
listFiles(args)
return
...
The server correctly avoids sending files to a user that isn't logged in and doesn't own the file.
However, the server will incorrectly list the files in any directory without confirming the command
came from an authenticated user, and that the user is authorized to see the directory's contents.
Here is a fixed version of the above example:
Example Language: Python (Good)
def dispatchCommand(command, user, args):
...
if command == 'List_files':
if authenticated(user) and ownsDirectory(user,args):
listFiles(args)
return
...
Observed Examples
CWE Version 4.14
CWE-841: Improper Enforcement of Behavioral Workflow
CWE-841: Improper Enforcement of Behavioral Workflow