COMMON WEAKNESS ENUMERATIONDraft

CWE-783

Operator Precedence Logic Error

The product uses an expression in which operator precedence causes incorrect logic to be used.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Low

Problemi anla

Problem nedir?

The product uses an expression in which operator precedence causes incorrect logic to be used.

Genişletilmiş açıklama

While often just a bug, operator precedence logic errors can have serious consequences if they are used in security-critical code, such as making an authentication decision.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Logic errors related to operator precedence may cause problems even during normal operation, so they are probably discovered quickly during the testing phase. If testing is incomplete or there is a strong reliance on manual review of the code, then these errors may not be discovered before the software is deployed.

Risk

Başarılı sömürü neye yol açar?

Varies by ContextUnexpected State

Etkilenen güvenlik alanları: Confidentiality, Integrity, Availability

The consequences will vary based on the context surrounding the incorrect precedence. In a security decision, integrity or confidentiality are the most likely results. Otherwise, a crash may occur due to the software reaching an unexpected state.

Savunma

Nasıl önlenir ve çözülür?

Implementation

Uygulama aşaması savunması

Detay
Regularly wrap sub-expressions in parentheses, especially in security-critical code.

Doğrulama

Nasıl tespit edilir?

Automated Static Analysis

High
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)