CWE-229, Improper Handling of Values, describes a product that does not properly handle the case where the expected number of values for parameters, fields or arguments is not provided, or where those values are undefined.
It is a parent to three narrower entries: missing values (CWE-230), extra values (CWE-231) and undefined values (CWE-232). Any code that reads request parameters, command-line arguments, message fields or configuration is a candidate.
How it happens
The code expects exactly what the specification says and indexes into it without checking. If a field is absent, repeated or unrecognized, the code reads the wrong thing or fails midway.
# Vulnerable: assumes exactly one value for "role"
role = request.args.getlist("role")[0]
If the parameter is absent, this raises an error. If it is sent twice, only the first is read and a different layer, such as a proxy, may have read the second.
MITRE's record lists no observed CVE examples for this entry.
What an attacker gains
MITRE lists integrity: the product ends up in an unexpected state. What follows depends on what the code does next with the wrong value.
How to find it
MITRE lists no detection methods. Test each input with the value count changed: none, one, many. Review code that indexes into lists of values or assumes every expected key is present.
How to fix it
MITRE gives no mitigations. Practical steps:
- Define for each input how many values are allowed and what happens outside that range.
- Check presence and count before use, and reject anything else with a clear error.
- Apply the same rules at every layer so they agree.
roles = request.args.getlist("role")
if len(roles) != 1:
abort(400)
role = roles[0]
Quick check
What are the narrower cases?
Missing values (CWE-230), extra values (CWE-231) and undefined values (CWE-232).
