CWE-703, Improper Check or Handling of Exceptional Conditions, is a pillar level weakness: the product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation. It is not language or technology specific.
Normal paths get tested every day. Exceptional ones, like a malformed packet, a failed allocation or a missing file, run rarely, so bugs there survive.
How it happens
MITRE lists two chains that show the range.
CVE-2022-22224: an operating system does not properly process malformed OSPF Type/Length/Value identifiers, which can cause the process to enter an infinite loop.
A second chain, from a cited reference, describes a JavaScript based cryptocurrency library that can fall back to the insecure Math.random() function instead of reporting a failure, reducing entropy and leading to generation of weak keys. A failure that should have stopped the operation was quietly replaced by a worse behavior.
A generic illustration of the second pattern:
# Vulnerable: on failure, silently use something weaker
try:
key = secure_random_bytes(32)
except Exception:
key = weak_random_bytes(32)
# Fixed: fail closed
key = secure_random_bytes(32) # let the error stop the operation
What an attacker gains
MITRE lists reading application data, denial of service through crash, exit or restart, and unexpected state, affecting confidentiality, availability and integrity. The attacker just needs to produce the rare condition on purpose.
How to find it
MITRE cites these techniques as highly cost effective: fault injection through dynamic analysis, manual source code review, and architecture or design review. Automated static analysis in source code is cost effective for partial coverage.
How to fix it
The record has no mitigation text. Sound practice, following from the examples:
- Decide what each failure means before writing the catch block. Stop, retry, or degrade safely.
- Fail closed on security operations. Never substitute a weaker fallback.
- Handle malformed input at the parser, with limits on loops, sizes and depth.
- Avoid broad catch blocks that swallow errors.
- Inject faults in tests: timeouts, empty responses, truncated data.
Quick check
What does "fail closed" mean?
When a security relevant operation fails, the system refuses to proceed rather than continuing with a weaker substitute.
Which MITRE listed technique is highly cost effective for finding this?
Fault injection, along with manual source code review and architecture or design review.
