CWE-230: Improper Handling of Missing Values

What is Improper Handling of Missing Values?

• Overview: CWE-230, Improper Handling of Missing Values, occurs when a software application does not correctly handle situations where a parameter, field, or argument name is specified without an associated value, such as being empty, blank, or null.

• Exploitation Methods:

• Attackers can exploit this vulnerability by providing inputs with missing values to cause unexpected behavior or bypass validation checks.
• Common attack patterns include injecting incomplete data to manipulate application logic or triggering errors that reveal sensitive information.

• Security Impact:

• Direct consequences of successful exploitation can include application crashes, bypassing of security controls, or unintended privilege escalation.
• Potential cascading effects involve data corruption or exposure of sensitive data due to improper error handling or logging.
• Business impact may include financial losses, damage to reputation, and potential legal liabilities if sensitive data is compromised.

• Prevention Guidelines:

• Specific code-level fixes involve implementing robust input validation to check for missing values and handle them appropriately.
• Security best practices include defining default values, using parameter validation libraries, and thorough testing for edge cases.
• Recommended tools and frameworks include static analysis tools to detect improper handling of inputs and frameworks that enforce strict input validation rules.

Corgea can automatically detect and fix Improper Handling of Missing Values in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

// This function loads configuration settings from a provided object
function loadConfig(config) {
    // Assume 'config' is an object that should contain certain keys
    const dbHost = config.dbHost;  // If 'dbHost' is missing, undefined is returned
    const dbPort = config.dbPort;  // If 'dbPort' is missing, undefined is returned
    const apiKey = config.apiKey;  // If 'apiKey' is missing, undefined is returned
    
    // Vulnerability: Proceed to use these values without checking if they are undefined
    // This can cause runtime errors or insecure operations
    connectToDatabase(dbHost, dbPort);
    authenticateWithApi(apiKey);
}

How to fix Improper Handling of Missing Values?

To address the issue of improper handling of missing values, it is crucial to validate the presence of required configuration parameters before using them. In JavaScript, this can be done by checking if the values are undefined and handling such cases by providing default values, throwing errors, or logging warnings. This ensures that the application does not continue with undefined values, which could lead to unexpected behavior or security vulnerabilities.

Fixed Code Example

// This function loads and validates configuration settings
function loadConfig(config) {
    // Extract critical configurations
    const dbHost = config.dbHost;
    const dbPort = config.dbPort;
    const apiKey = config.apiKey;
    
    // Check if required configurations are missing
    if (dbHost === undefined || dbPort === undefined) {
        // Fix: Throw an error if critical database configuration is missing
        throw new Error("Database host and port must be specified in the configuration.");
    }
    
    if (apiKey === undefined) {
        // Fix: Throw an error if the API key is missing
        throw new Error("API key must be specified in the configuration.");
    }
    
    // If all checks pass, proceed to use these values
    connectToDatabase(dbHost, dbPort);
    authenticateWithApi(apiKey);
}

These examples demonstrate how to handle missing values securely in JavaScript. By enforcing validation checks, we prevent the application from operating with incomplete configurations, which could lead to security vulnerabilities or system failures. The fixed example ensures that the application validates critical configuration parameters before proceeding, thereby maintaining robust security practices.