2361
Nature Type ID Name Page
HasMember 708 Incorrect Ownership Assignment 699 1548
HasMember 770 Allocation of Resources Without Limits or Throttling 699 1613
HasMember 826 Premature Release of Resource During Expected
Lifetime
699 1734
HasMember 837 Improper Enforcement of a Single, Unique Action 699 1762
HasMember 841 Improper Enforcement of Behavioral Workflow 699 1772
Notes
Terminology
The "Business Logic" term is generally used to describe issues that require domain-specific
knowledge or "business rules" to determine if they are weaknesses or vulnerabilities, instead
of legitimate behavior. Such issues might not be easily detectable via automatic code analysis,
because the associated operations do not produce clear errors or undefined behavior at the
code level. However, many such "business logic" issues can be understood as instances of other
weaknesses such as input validation, access control, numeric computation, order of operations,
etc.
Research Gap
The classification of business logic flaws has been under-studied, although exploitation of
business flaws frequently happens in real-world systems, and many applied vulnerability
researchers investigate them. The greatest focus is in web applications. There is debate within
the community about whether these problems represent particularly new concepts, or if they
are variations of well-known principles. Many business logic flaws appear to be oriented toward
business processes, application flows, and sequences of behaviors, which are not as wellrepresented
in CWE as weaknesses related to input validation, memory management, etc.
References
[REF-795]Jeremiah Grossman. "Business Logic Flaws and Yahoo Games". 2006 December 8. <
https://blog.jeremiahgrossman.com/2006/12/business-logic-flaws.html >.2023-04-07.
[REF-796]Jeremiah Grossman. "Seven Business Logic Flaws That Put Your Website At Risk".
2007 October. < https://docplayer.net/10021793-Seven-business-logic-flaws-that-put-your-websiteat-
risk.html >.2023-04-07.
[REF-797]WhiteHat Security. "Business Logic Flaws". < https://web.archive.org/
web/20080720171327/http://www.whitehatsec.com/home/solutions/BL_auction.html >.2023-04-07.
[REF-798]WASC. "Abuse of Functionality". < http://projects.webappsec.org/w/page/13246913/
Abuse-of-Functionality >.
[REF-799]Rafal Los and Prajakta Jagdale. "Defying Logic: Theory, Design, and Implementation
of Complex Systems for Testing Application Logic". 2011. < https://www.slideshare.net/RafalLos/
defying-logic-business-logic-testing-with-automation >.2023-04-07.
[REF-667]Rafal Los. "Real-Life Example of a 'Business Logic Defect' (Screen Shots!)". 2011. <
http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-Example-of-a-Business-
Logic-Defect-Screen-Shots/ba-p/22581 >.
[REF-801]Viktoria Felmetsger, Ludovico Cavedon, Christopher Kruegel and Giovanni Vigna.
"Toward Automated Detection of Logic Vulnerabilities in Web Applications". USENIX Security
Symposium 2010. 2010 August. < https://www.usenix.org/legacy/events/sec10/tech/full_papers/
Felmetsger.pdf >.2023-04-07.
[REF-802]Faisal Nabi. "Designing a Framework Method for Secure Business Application Logic
Integrity in e-Commerce Systems". International Journal of Network Security, Vol.12, No.1. 2011. <
http://ijns.femto.com.tw/contents/ijns-v12-n1/ijns-2011-v12-n1-p29-41.pdf >.
CWE Version 4.14
CWE-845: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation
and Data Sanitization (IDS)
CWE-845: The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 2 - Input Validation and Data Sanitization (IDS) 2362
[REF-1102]Chetan Conikee. "Case Files from 20 Years of Business Logic Flaws".
2020 February. < https://published-prd.lanyonevents.com/published/rsaus20/
sessionsFiles/18217/2020_USA20_DSO-R02_01_Case%20Files%20from%2020%20Years%20of
%20Business%20Logic%20Flaws.pdf >.
Category-845: The CERT Oracle Secure Coding Standard for Java (2011)
Chapter 2 - Input Validation and Data Sanitization (IDS)
Category ID : 845
Summary
Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS)
chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Membership
Nature Type ID Name Page
MemberOf 844 Weaknesses Addressed by The CERT Oracle Secure
Coding Standard for Java (2011)
844 2564
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
844 151
HasMember 116 Improper Encoding or Escaping of Output 844 281
HasMember 134 Use of Externally-Controlled Format String 844 365
HasMember 144 Improper Neutralization of Line Delimiters 844 383
HasMember 150 Improper Neutralization of Escape, Meta, or Control
Sequences
844 394
HasMember 180 Incorrect Behavior Order: Validate Before Canonicalize 844 451
HasMember 182 Collapse of Data into Unsafe Value 844 455
HasMember 289 Authentication Bypass by Alternate Name 844 703
HasMember 409 Improper Handling of Highly Compressed Data (Data
Amplification)
844 996
HasMember 625 Permissive Regular Expression 844 1392
HasMember 647 Use of Non-Canonical URL Paths for Authorization
Decisions
844 1426
HasMember 838 Inappropriate Encoding for Output Context 844 1764
References
[REF-813]Fred Long, Dhruv Mohindra, Robert C. Seacord, Dean F. Sutherland and David
Svoboda. "The CERT Oracle Coding Standard for Java". 1st Edition. 2011 September 8. Addison-
Wesley Professional.
Category-846: The CERT Oracle Secure Coding Standard for Java (2011)
Chapter 3 - Declarations and Initialization (DCL)
Category ID : 846
Summary
Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter
of The CERT Oracle Secure Coding Standard for Java (2011).
Membership
CWE Version 4.14
CWE-847: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions
(EXP)
CWE-847: The CERT Oracle Secure Coding Standard
for Java (2011) Chapter 4 - Expressions (EXP)