CWE-628: Function Call with Incorrectly Specified Arguments

What is Function Call with Incorrectly Specified Arguments?

• Overview: Function Call with Incorrectly Specified Arguments is a vulnerability where a function is called with arguments that are not specified correctly, causing incorrect behavior. This can occur due to using the wrong variable, incorrect number of arguments, wrong order, wrong type, or wrong value.

• Exploitation Methods:

• Attackers can exploit this vulnerability by supplying unexpected inputs or manipulating the argument values to cause unintended behavior or bypass security controls.
• Common attack patterns include crafting inputs that exploit type mismatches or taking advantage of argument order to change the logic flow.

• Security Impact:

• Direct consequences include crashes, incorrect program logic, and potential exposure of sensitive data.
• Potential cascading effects involve compromising other system components due to incorrect function behavior.
• Business impact could result in data breaches, loss of customer trust, and financial loss due to system downtime or data corruption.

• Prevention Guidelines:

• Specific code-level fixes include validating arguments before use and ensuring functions are called with the correct number and type of arguments.
• Security best practices involve thorough testing, code reviews, and use of static analysis tools to detect argument-related vulnerabilities.
• Recommended tools and frameworks include those that offer type safety and enforce strict argument checks, such as using languages or frameworks that support strong type systems.

Corgea can automatically detect and fix Function Call with Incorrectly Specified Arguments in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

def process_payment(amount, currency):
    # Intended to process a payment with a specified amount and currency
    print(f"Processing payment of {amount} in {currency}")

# Vulnerable function call with incorrectly specified arguments
process_payment(100)  # Missing the 'currency' argument, leading to a TypeError

Explanation:

In this vulnerable code, the process_payment function is designed to take two arguments: amount and currency. However, the function call only specifies the amount, leading to a TypeError due to the missing currency argument. This omission can cause the program to crash or behave unpredictably, especially if the missing argument is crucial for further business logic, such as currency conversion or validation.

How to fix Function Call with Incorrectly Specified Arguments?

To fix this vulnerability, always ensure that all required arguments are provided when calling a function. Moreover, it's a good practice to use keyword arguments when possible, as they make the code more readable and reduce the risk of incorrect argument order. You can also provide default values for optional arguments to prevent the function from crashing when they are omitted.

Fixed Code Example

def process_payment(amount, currency='USD'):  # Added a default value for the 'currency' argument
    # Processes a payment with a specified amount and currency
    print(f"Processing payment of {amount} in {currency}")

# Fixed function call with correctly specified arguments
process_payment(amount=100)  # Using keyword arguments for clarity and correctness

Explanation:

• Default Argument: By providing a default value for the currency parameter, the function can still operate with a sensible default if the caller does not specify a currency. This prevents the function from raising an error due to missing arguments.
• Keyword Arguments: Using keyword arguments ensures that each argument is assigned to the correct parameter, preventing issues related to incorrect argument order and improving code readability.

By implementing these changes, the function is more robust, flexible, and less prone to errors related to incorrect argument specification.