Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-754 (对因果或异常条件的不恰当检查) — Vulnerability Class 272

272 vulnerabilities classified as CWE-754 (对因果或异常条件的不恰当检查). AI Chinese analysis included.

CWE-754 represents a critical software weakness where applications fail to properly validate or handle unexpected environmental states, such as resource exhaustion, permission denials, or malformed inputs. Developers often exploit this oversight by assuming routine operational conditions will always hold true, leading to crashes, data corruption, or security breaches when rare events occur. Attackers typically trigger these exceptional conditions to cause denial-of-service attacks or to bypass security controls by forcing the application into an undefined state. To mitigate this risk, engineers must implement robust error handling mechanisms that explicitly check for and gracefully manage unusual scenarios. This includes validating resource availability, verifying user permissions, and ensuring inputs meet expected formats before processing, thereby maintaining system stability and security even under adverse or unexpected operating conditions.

MITRE CWE Description
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer's assumptions, possibly introducing instability, incorrect behavior, or a vulnerability. Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.
Common Consequences (1)
Integrity, AvailabilityDoS: Crash, Exit, or Restart, Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
Mitigations (5)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions…
ImplementationCheck the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
ImplementationIf using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Effectiveness: High
ImplementationEnsure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Examples (2)
Consider the following code segment:
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);
Bad · C
The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().
buf = (char*) malloc(req_size); strncpy(buf, xfer, req_size);
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2019-6819 多款Schneider Electric产品代码问题漏洞 — Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium 7.5 -2019-05-22
CVE-2019-1849 Cisco IOS XR Software BGP MPLS-Based EVPN Denial of Service Vulnerability — Cisco IOS XR Software 6.5 -2019-05-16

Vulnerabilities classified as CWE-754 (对因果或异常条件的不恰当检查) represent 272 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.