Return of Wrong Status Code
This vulnerability occurs when a function returns an inaccurate status code or value that misrepresents the actual outcome of an operation. This false signal can cause the application to behave in unexpected and potentially insecure ways.
When a system relies on these incorrect return codes to make decisions, it can lead to unpredictable application states, logic errors, and instability. For example, a function might incorrectly report a successful file deletion or a failed authentication check, causing the program flow to proceed down the wrong path. If these status checks are part of security-critical logic—like access control, authentication, or data validation—the consequences are severe. The application might grant access to unauthorized users, assume a dangerous operation succeeded safely, or fail to alert on genuine security failures, creating hidden vulnerabilities that attackers can exploit.
Impact: Unexpected StateAlter Execution Logic
This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.
ID : DX-186
In the following example, an HTTP 404 status code is returned in the event of an IOException encountered in a Java servlet. A 404 code is typically meant to indicate a non-existent resource and would be somewhat misleading in this case.Code Example:
java// something that might throw IOException* ...} catch (IOException ioe) { ``` response.sendError(SC_NOT_FOUND); }
- PLOVER
- Software Fault Patterns