1543
Example Language: Java (Bad)
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {
String ip = req.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
...
out.println("hello " + addr.getHostName());
}
A DNS lookup failure will cause the Servlet to throw an exception.
Example 2:
This code queries a server and displays its status when a request comes from an authorized IP
address.
Example Language: PHP (Bad)
$requestingIP = $_SERVER['REMOTE_ADDR'];
if(!in_array($requestingIP,$ipAllowList)){
echo "You are not authorized to view this page";
http_redirect($errorPageURL);
}
$status = getServerStatus();
echo $status;
...
This code redirects unauthorized users, but continues to execute code after calling http_redirect().
This means even unauthorized users may be able to access the contents of the page or perform
a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address
spoofing attack (CWE-212).
Example 3:
Included in the doPost() method defined below is a call to System.exit() in the event of a specific
exception.
Example Language: Java (Bad)
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try {
...
} catch (ApplicationSpecificException ase) {
logger.error("Caught: " + ase.toString());
System.exit(1);
}
}
Observed Examples
Reference Description
CVE-2023-21087 Java code in a smartphone OS can encounter a "boot loop" due to an
uncaught exception
https://www.cve.org/CVERecord?id=CVE-2023-21087
CVE-2014-1266 chain: incorrect "goto" in Apple SSL product bypasses certificate validation,
allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug).
CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) ->
CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong
Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
https://www.cve.org/CVERecord?id=CVE-2014-1266
MemberOf Relationships
CWE Version 4.14
CWE-706: Use of Incorrectly-Resolved Name or Reference
CWE-706: Use of Incorrectly-Resolved Name or Reference