CWE-408: Incorrect Behavior Order: Early Amplification
Incorrect Behavior Order: Early Amplification
Weakness ID: 408 (Weakness Base)
Status: Draft
Description
Description Summary
The software allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Availability
Technical Impact: DoS: amplification
Demonstrative Examples
Example 1
This data prints the contents of a specified file requested by a
user.
(Bad Code)
Example
Language: PHP
function printFile($username,$filename){
//read file into string
$file = file_get_contents($filename);
if ($file && isOwnerOf($username,$filename)){
echo $file;
return true;
}
else{
echo 'You are not authorized to view this file';
}
return false;
}
This code first reads a specified file into memory, then prints the
file if the user is authorized to see its contents. The read of the file
into memory may be resource intensive and is unnecessary if the user is
not allowed to see the file anyway.
Description
