CWE-231, Improper Handling of Extra Values, applies when a product does not handle, or mishandles, receiving more values than it expects.
It affects anything that reads lists of arguments, repeated query parameters, repeated headers or arrays of fields.
How it happens
A function written for one value gets two. Depending on the code, it takes the first, takes the last, joins them, or fails. If two components in the same request path pick differently, a check can be applied to one value while the action uses another.
# Vulnerable: layers disagree about which "amount" counts
amounts = request.args.getlist("amount") # ["10", "9999"]
validate(amounts[0]) # checks the first
charge(amounts[-1]) # uses the last
MITRE's record lists no observed CVE examples for this entry.
What an attacker gains
MITRE lists integrity: the product ends up in an unexpected state. The consequences depend on what the code then does with the unintended value.
How to find it
MITRE lists no detection methods. For each input, send two or more values where one is expected, and send extra arguments and fields. Compare what each layer, such as proxy, framework and application, sees.
How to fix it
MITRE gives no mitigations. Practical steps:
- Decide the maximum count for each input.
- Reject requests with more than the allowed number instead of silently choosing one.
- Read the value once and pass that same value to both validation and use.
amounts = request.args.getlist("amount")
if len(amounts) != 1:
abort(400)
amount = amounts[0]
validate(amount)
charge(amount)
Quick check
Why reject instead of using the first value?
Another layer may use the last one. Rejecting removes the disagreement.
