CWE-768: Incorrect Short Circuit Evaluation

What is Incorrect Short Circuit Evaluation?

• Overview: Incorrect Short Circuit Evaluation occurs when a conditional statement with multiple logical expressions has non-leading expressions that produce side effects, which may not execute due to short-circuiting, leading to unexpected program states.

• Exploitation Methods:

• Attackers can exploit this vulnerability by manipulating input to trigger or bypass certain conditions, causing unintended side effects.
• Common attack patterns include crafting inputs that ensure certain conditions are met or not met, leading to unexecuted expressions that affect the program's logic.

• Security Impact:

• Direct consequences include unexpected behavior or program states that can lead to vulnerabilities.
• Potential cascading effects include logic errors that may compromise data integrity, availability, or confidentiality.
• Business impact may involve system downtime, data breaches, or loss of customer trust due to exploited vulnerabilities.

• Prevention Guidelines:

• Specific code-level fixes include avoiding side effects in non-leading expressions of conditionals and ensuring all necessary expressions are evaluated.
• Security best practices involve thorough code reviews focusing on conditional logic and testing for edge cases where short-circuiting may alter expected behavior.
• Recommended tools and frameworks include static analysis tools that detect potential short-circuit evaluation issues and enforce coding standards that discourage such practices.

Corgea can automatically detect and fix Incorrect Short Circuit Evaluation in your codebase. Try Corgea free today.

Technical Details

Likelihood of Exploit: Low

Affected Languages: Not specified

Affected Technologies: Not specified