CWE-480: Use of Incorrect Operator

What is Use of Incorrect Operator?

• Overview: The Use of Incorrect Operator vulnerability occurs when a software product uses the wrong operator, leading to unintended logic changes. These errors are typically the result of typos by the programmer and can affect security-critical code.

• Exploitation Methods:

• Attackers can exploit this vulnerability by triggering the incorrect logic path, potentially bypassing security checks or altering program behavior.
• Common attack patterns include manipulating inputs to reach code paths where the incorrect operator impacts authentication, authorization, or data validation.

• Security Impact:

• Direct consequences include the bypass of security mechanisms, unauthorized access, or data corruption.
• Potential cascading effects might involve further system compromise, data leaks, or enabling additional vulnerabilities.
• Business impact could include reputational damage, financial loss, or compliance violations due to compromised data integrity or security.

• Prevention Guidelines:

• Specific code-level fixes include thorough code reviews and ensuring operators are correctly applied in all logic statements.
• Security best practices involve implementing automated static analysis tools to catch operator misuse and incorporating peer review processes in the development lifecycle.
• Recommended tools and frameworks include using integrated development environments (IDEs) with built-in linting tools and enabling compiler warnings for suspicious code patterns.

Corgea can automatically detect and fix Use of Incorrect Operator in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Low

Affected Languages: C, C++, Perl, Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

// This function checks if a user is authorized.
// Due to an incorrect operator, the logic is flawed.
#include <stdio.h>
#include <stdbool.h>

// Function to check user authorization
bool isAuthorized(int userRole, int requiredRole) {
    // Vulnerability: The assignment operator '=' is used instead of '=='
    // This causes userRole to be assigned the value of requiredRole, always returning true
    if (userRole = requiredRole) {  // Incorrect use of '='
        return true;
    }
    return false;
}

int main() {
    int userRole = 1; // Normal user
    int requiredRole = 2; // Admin role required

    if (isAuthorized(userRole, requiredRole)) {
        printf("Access granted.\n");
    } else {
        printf("Access denied.\n");
    }
    return 0;
}

How to fix Use of Incorrect Operator?

The error in the vulnerable code is the misuse of the assignment operator '=' instead of the equality operator '=='. This mistake leads to unintended logic where the condition always evaluates to true because the variable userRole is assigned the value of requiredRole, instead of being compared to it.

To fix the vulnerability, replace the assignment operator '=' with the equality operator '=='. This ensures the expression evaluates as a comparison, checking whether userRole is equal to requiredRole, which is the intended logic for authorization checks.

Fixed Code Example

// Corrected function to check user authorization.
#include <stdio.h>
#include <stdbool.h>

// Function to check user authorization
bool isAuthorized(int userRole, int requiredRole) {
    // Fix: Use the equality operator '==' to compare values correctly
    if (userRole == requiredRole) {  // Correct use of '=='
        return true;
    }
    return false;
}

int main() {
    int userRole = 1; // Normal user
    int requiredRole = 2; // Admin role required

    if (isAuthorized(userRole, requiredRole)) {
        printf("Access granted.\n");
    } else {
        printf("Access denied.\n");
    }
    return 0;
}

In the fixed code example, the use of '==' instead of '=' ensures that the condition checks if userRole is equal to requiredRole. This corrects the logic flaw, allowing the program to properly determine if the user has the necessary permissions. This change prevents unauthorized access and aligns with security best practices for handling authorization logic.