CWE-372, Incomplete Internal State Distinction, is the weakness of not knowing what state you are in. MITRE describes a product that does not properly determine which state it is in, so it assumes state X when it is really in state Y, and then performs incorrect operations in a security relevant way.
It shows up in anything with a lifecycle: login flows, protocol handshakes, payment steps, session handling, file processing.
How it happens
State is usually tracked by a few variables, a flag here, a status field there. Over time more states are added, and the checks do not keep up. Two states look alike to the code. A half finished login looks like a finished one. An error path leaves flags set from a prior step.
The result is a program that takes an action valid only in one state while sitting in another.
What an attacker gains
The record lists integrity impact and an unexpected state, with effects that vary by context. What an attacker gets depends on which action the confused state allows. Skipping a verification step is the classic worry.
How to find it
The record has no detection methods and no observed CVEs for this entry. Use design review.
- Draw the state machine. Name every state and every legal transition.
- Check that each security sensitive action verifies the exact state it needs, not a proxy for it.
- Test out of order sequences: step three before step two, repeated steps, abandoned flows.
How to fix it
MITRE lists no mitigations here. These steps follow from the definition.
- Represent state explicitly, with one authoritative value instead of several flags that can disagree.
- Reject any transition that is not on the diagram.
- Reset state fully on error and on timeout.
- Have sensitive operations assert the state they require.
Quick check
What is the simplest design habit that prevents this weakness?
Use a single explicit state value and an allowed transition list, so the program cannot drift into an undefined combination.
Sources
- MITRE CWE-372: https://cwe.mitre.org/data/definitions/372.html
