CWE-230, Improper Handling of Missing Values, covers a product that does not handle, or mishandles, a parameter, field or argument that is named but has no value: empty, blank or null.
Web servers, parsers, API handlers and any code reading headers or form fields can hit it.
How it happens
Developers test for "present" and "valid", and forget "present but empty". MITRE's observed examples show how often that gap matters:
- CVE-2002-0422: a blank Host header triggers an information leak.
- CVE-2000-1006: a blank charset attribute in a MIME header triggers a crash.
- CVE-2004-1504 and CVE-2005-2053: a blank parameter causes an externally generated error that leaks information.
// Vulnerable: key exists, value is the empty string
const id = req.query.id; // "?id=" gives ""
const user = db.users[id.toLowerCase()].profile; // throws on undefined
The thrown error may then reach the user, which is its own weakness (see CWE-211).
What an attacker gains
MITRE lists integrity: the product moves into an unexpected state. Two of the examples above went on to leak information, and one crashed the product.
How to find it
MITRE lists no detection methods. For every parameter, header and field, send the name with an empty value, with whitespace only, and with an explicit null where the format allows. Watch for crashes and verbose errors.
How to fix it
MITRE gives no mitigations. Practical steps:
- Treat empty and absent as separate cases and decide for each whether it is acceptable.
- Validate before use, and return a plain 400 with a generic message for bad input.
- Keep error pages generic so a missed case does not leak a path or query.
const id = (req.query.id || "").trim();
if (!id) return res.status(400).send("Bad request");
Quick check
Why test an empty value separately from a missing one?
They take different code paths. A name with no value passes a presence check but can still break code that expects content.
