logo

Incorrect Behavior Order

Incomplete Class
Structure: Simple
Description

This weakness occurs when a system executes multiple dependent actions in the wrong sequence, leading to unexpected and potentially vulnerable states.

Extended Description

Think of this as a race condition in logic, not just in threads. When operations like initialization, validation, state updates, or cleanup happen out of order, the application can be left in an inconsistent state. For example, using a resource before it's properly initialized, checking permissions after granting access, or cleaning up a log file before writing an error entry can all open doors to security issues, crashes, or data corruption. Developers can prevent this by explicitly modeling and enforcing the required sequence of operations in their code. Using state machines, well-defined lifecycle hooks, or design patterns that mandate order (like dependency injection or builder patterns) can help. Always ask: 'What must happen before this step, and what depends on this step being complete?' Testing should include verifying behavior sequences under different conditions, not just individual function outputs.
Common Consequences 1
Scope: Integrity

Impact: Alter Execution Logic
Demonstrative Examples 3

ID : DX-35

The following code attempts to validate a given input path by checking it against an allowlist and then return the canonical path. In this specific case, the path is considered valid if it starts with the string "/safe_dir/".

Code Example:

Bad
Java
java
The problem with the above code is that the validation step occurs before canonicalization occurs. An attacker could provide an input path of "/safe_dir/../" that would pass the validation step. However, the canonicalization process sees the double dot as a traversal to the parent directory and hence when canonicized the path would become just "/".
To avoid this problem, validation should occur after canonicalization takes place. In this case canonicalization occurs during the initialization of the File object. The code below fixes the issue.

Code Example:

Good
Java
java

ID : DX-157

This function prints the contents of a specified file requested by a user.

Code Example:

Bad
PHP
php

//read file into string* $file = file_get_contents($filename); if ($file && isOwnerOf($username,$filename)){ ``` echo $file; return true; } else{ echo 'You are not authorized to view this file'; } return false; }

This code first reads a specified file into memory, then prints the file if the user is authorized to see its contents. The read of the file into memory may be resource intensive and is unnecessary if the user is not allowed to see the file anyway.
ID : DX-187
Assume that the module foo_bar implements a protected register. The register content is the asset. Only transactions made by user id (indicated by signal usr_id) 0x4 are allowed to modify the register contents. The signal grant_access is used to provide access.
Code Example:
Bad
Verilog
module foo_bar(data_out, usr_id, data_in, clk, rst_n);
output reg [7:0] data_out;
input wire [2:0] usr_id;
input wire [7:0] data_in;
input wire clk, rst_n;
wire grant_access;
always @ (posedge clk or negedge rst_n)
begin


verilog
This code uses Verilog blocking assignments for data_out and grant_access. Therefore, these assignments happen sequentially (i.e., data_out is updated to new value first, and grant_access is updated the next cycle) and not in parallel. Therefore, the asset data_out is allowed to be modified even before the access control check is complete and grant_access signal is set. Since grant_access does not have a reset value, it will be meta-stable and will randomly go to either 0 or 1.
Flipping the order of the assignment of data_out and grant_access should solve the problem. The correct snippet of code is shown below.
Code Example:
Good
Verilog
always @ (posedge clk or negedge rst_n)
begin


verilog
  
Observed Examples 4
CVE-2019-9805Chain: Creation of the packet client occurs before initialization is complete (Incorrect Behavior Order) resulting in a read from uninitialized memory (Use of Uninitialized Resource), causing memory corruption.
CVE-2007-5191file-system management programs call the setuid and setgid functions in the wrong order and do not check the return values, allowing attackers to gain unintended privileges
CVE-2007-1588C++ web server program calls Process::setuid before calling Process::setgid, preventing it from dropping privileges, potentially allowing CGI programs to be called with higher privileges than intended
CVE-2022-37734Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (Incorrect Behavior Order), allowing excessive CPU consumption (Inefficient CPU Computation)
   
  
      
 
 
Modes of Introduction 
 
 
 
 
 
  Architecture and Design  
 
  Implementation  
 
 
 
  
Related Attack Patterns 
        
 
 
Related Weaknesses 
 
 
 
 
  ChildOf:
 Insufficient Control Flow Management (CWE-691) 
 
 
 
 
Taxonomy Mapping 
  • CERT C Secure Coding