CWE-1288: Improper Validation of Consistency within Input

What is Improper Validation of Consistency within Input?

• Overview: Improper Validation of Consistency within Input (CWE-1288) occurs when a software system receives complex inputs containing multiple related fields or elements, but fails to ensure these elements are consistent with each other. This can lead to incorrect processing or unexpected behavior.

• Exploitation Methods:

• Attackers can manipulate input data to create inconsistencies, potentially causing the system to behave unpredictably or fail.
• Common attack patterns include sending mismatched data, such as a declared number of items not matching the actual items provided, to disrupt application logic.

• Security Impact:

• Direct consequences of successful exploitation include triggering errors, incorrect data processing, or unintended actions.
• Potential cascading effects include exposing latent vulnerabilities, leading to further security breaches.
• Business impact may involve data corruption, loss of integrity, service disruption, or reputational damage.

• Prevention Guidelines:

• Specific code-level fixes include implementing thorough checks to verify the consistency of input data before processing.
• Security best practices involve input validation and sanitization, ensuring all interrelated fields are consistent and in expected formats.
• Recommended tools and frameworks include using libraries or functions that offer robust validation and parsing capabilities, along with automated testing tools to identify inconsistencies in input handling.

Corgea can automatically detect and fix Improper Validation of Consistency within Input in your codebase. Try Corgea free today.

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

Python Example

def process_order(order):
    """
    Processes an order with a given structure:
    order = {
        'product_id': '123',
        'quantity': 2,
        'total_price': 40.00
    }
    """
    product_price = get_product_price(order['product_id'])
    
    # Vulnerable code: does not check consistency between quantity and total_price
    if product_price * order['quantity'] != order['total_price']:
        raise ValueError("Inconsistent order: Total price does not match quantity times product price")
    
    # Proceed with order processing

In this vulnerable code example, the program assumes that the total_price provided in the order is correct without verifying it against the calculated price derived from the product_price and quantity. This can lead to processing orders with incorrect pricing, allowing for potential exploitation.

How to fix Improper Validation of Consistency within Input?

Improper validation of consistency within input can lead to security vulnerabilities, such as incorrect or manipulated data being processed, which can cause financial loss or incorrect system behavior. The vulnerability arises when the program does not verify if the total_price matches the expected price calculated using quantity and product_price.

To fix this, implement a validation step that checks if the total_price is consistent with the expected total derived from the quantity and the product_price. If there's a discrepancy, the program should raise an appropriate error or handle it according to the business logic.

Fixed Code Example

def process_order(order):
    """
    Processes an order with a given structure:
    order = {
        'product_id': '123',
        'quantity': 2,
        'total_price': 40.00
    }
    """
    product_price = get_product_price(order['product_id'])
    
    # Fixed code: Properly validate the consistency of total_price
    expected_total_price = product_price * order['quantity']
    if order['total_price'] != expected_total_price:
        raise ValueError(f"Inconsistent order: Expected total price is {expected_total_price}, but got {order['total_price']}")
    
    # Proceed with order processing

In the fixed code example, we calculate the expected_total_price using the product_price and quantity, and then check if it matches the provided total_price. If there is a discrepancy, an error is raised, preventing the order from being processed with inconsistent data. This ensures that input values are consistent, preventing potential fraud or errors. The comments and error messages provide clear feedback on what went wrong, aiding in debugging and maintaining the code.