Improper Enforcement of Behavioral Workflow
This weakness occurs when an application requires a user to follow a specific sequence of actions, but fails to enforce that order. Attackers can exploit this by skipping steps, performing actions out of sequence, or interrupting the flow, which can corrupt the business logic or put the system into an invalid state.
When a multi-step process isn't strictly sequenced, attackers can manipulate it to bypass critical checks. For instance, a file-sharing server might require a username, then a password, before allowing a file transfer. If it accepts a transfer command immediately after a password—without a username—the core authentication workflow is broken, potentially granting unauthorized access. Proper workflow enforcement means ensuring steps happen in the correct order, no required steps are omitted, processes aren't maliciously interrupted, and actions occur within a reasonable timeframe. This is distinct from software itself executing steps incorrectly (CWE-696); here, the flaw is in failing to control the *user's* or *client's* path through the required behaviors.
Impact: Alter Execution Logic
An attacker could cause the product to skip critical steps or perform them in the wrong order, bypassing its intended business logic. This can sometimes have security implications.
Code Example:
pythonuser has requested a file*
pythonpythonCode Example:
python...* if command == 'List_files': ``` if authenticated(user) and ownsDirectory(user,args): listFiles(args) return
python- WASC