CWE-606 Base Rascunho

Unchecked Input for Loop Condition

Definição

What is CWE-606?

This vulnerability occurs when an application fails to properly validate or limit user-supplied values that control loop iterations. Without these checks, malicious input can force the program into an endless or excessively long loop, consuming system resources and leading to denial of service or application instability.

At its core, this weakness allows an attacker to manipulate a program's flow by controlling how many times a loop executes. Common scenarios include using an unexpectedly large integer for a counter, a negative number that bypasses termination logic, or a specially crafted string that causes unexpected parsing behavior within the loop condition. Developers often trust these values from sources like configuration files, APIs, or user inputs without implementing strict bounds checking. To prevent this, always validate and sanitize any external input before it determines loop behavior. Implement explicit limits on maximum iterations, use signed/unsigned integer checks to prevent wrap-around issues, and consider adding timeout mechanisms for processing loops. Treat loop control variables with the same level of distrust as any other user input, as they directly control resource consumption and application availability.

Impacto no mundo real

Real-world CVEs caused by CWE-606

Ainda não há referências CVE públicas associadas a este CWE no catálogo da MITRE.

Como os atacantes a exploram

Trajeto do atacante passo a passo

1
The following example demonstrates the weakness.
2
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
3
However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (CWE-606). If msgLength indicates a length that is longer than the size of a message body (CWE-130), then this can result in a buffer over-read by reading past the end of the buffer (CWE-126).

Exemplo de código vulnerável

Vulnerable C

The following example demonstrates the weakness.

Vulnerável C

void iterate(int n){
  	int i;
  	for (i = 0; i < n; i++){
  		foo();
  	}
  }
  void iterateFoo()
  {
  	unsigned int num;
  	scanf("%u",&num);
  	iterate(num);
  }

Exemplo de código seguro

Secure pseudo

Seguro pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Lista de verificação de prevenção

How to prevent CWE-606

Implementation Do not use user-controlled data for loop conditions.
Implementation Perform input validation.

Sinais de deteção

How to detect CWE-606

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Correção automática do Plexicus

O Plexicus deteta automaticamente o CWE-606 e abre um PR de correção em menos de 60 segundos.

O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.

Obter uma demonstração Experimente o Plexicus gratuitamente

Perguntas frequentes

Frequently asked questions

O que é o CWE-606?

Qual a gravidade do CWE-606?

A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.

Que linguagens ou plataformas são afetadas pelo CWE-606?

A MITRE não especificou as plataformas afetadas por este CWE — pode aplicar-se à maioria das stacks de aplicações.

Como posso prevenir o CWE-606?

Do not use user-controlled data for loop conditions. Perform input validation.

Como é que o Plexicus deteta e corrige o CWE-606?

O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-606 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.

Onde posso saber mais sobre o CWE-606?

A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/606.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.

Fraquezas relacionadas

Weaknesses related to CWE-606

CWE-1284 Pai

Improper Validation of Specified Quantity in Input

This vulnerability occurs when an application accepts user input meant to define a quantity—like a number, size, or count—but fails to…

CWE-834 Pode preceder

Excessive Iteration

This vulnerability occurs when a program runs a loop too many times because it lacks proper limits on its iterations.

Recursos

Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.

O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.

Começar grátis Reservar uma demo