CWE-697: Incorrect Comparison

What is Incorrect Comparison?

• Overview: Incorrect Comparison (CWE-697) occurs when a software product makes a faulty comparison between two entities in a context where security is important. This can happen if the wrong factors are checked, not all necessary factors are considered, or a factor is assessed incorrectly.

• Exploitation Methods:

• Attackers might exploit incorrect comparisons to bypass authentication mechanisms or authorization checks.
• Common attack patterns include manipulating inputs to trigger incorrect comparisons, exploiting logic errors in comparison algorithms, and using side-channel attacks to infer comparison inaccuracies.

• Security Impact:

• Direct consequences of successful exploitation include unauthorized access, privilege escalation, and data exposure.
• Potential cascading effects could involve system compromise, data integrity violations, and further exploitation of interconnected systems.
• Business impact may include financial loss, reputational damage, legal liabilities, and regulatory non-compliance.

• Prevention Guidelines:

• Specific code-level fixes involve ensuring that all relevant factors are checked correctly in comparisons and validating the logic used for comparisons.
• Security best practices include regular code reviews, implementing consistent and thorough testing, and adhering to well-established coding standards to avoid logic errors.
• Recommended tools and frameworks are static analysis tools to detect logical errors and security-focused libraries that provide safe comparison functions.

Corgea can automatically detect and fix Incorrect Comparison in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not Technology-Specific

Vulnerable Code Example

function isAuthenticated(userInputPassword, storedPasswordHash) {
    // Vulnerability: Directly comparing a plaintext password with a hashed password
    // This comparison will always fail because a plaintext password will not match its hash
    if (userInputPassword === storedPasswordHash) {
        return true;
    }
    return false;
}

How to fix Incorrect Comparison?

In this JavaScript example, the issue arises from directly comparing a plaintext password with a hashed password, which is inherently incorrect. The comparison will always fail unless the passwords are compared in a secure, hashed manner.

Fix Approach:

1. Use a library like bcryptjs to handle password hashing and comparison securely.
2. Hash the user input password using the same algorithm and salt as the stored password hash before comparison.

Fixed Code Example

const bcrypt = require('bcryptjs');

function isAuthenticated(userInputPassword, storedPasswordHash) {
    // Fix: Use bcrypt's compareSync method to securely compare the hashed user input with the stored hash
    // This method ensures that the comparison is done in a safe manner, protecting against timing attacks
    return bcrypt.compareSync(userInputPassword, storedPasswordHash);
}

By using bcryptjs to handle password hashing and comparison, we ensure that the authentication process is secure, preventing incorrect comparisons and potential security vulnerabilities.