CWE

Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (2.11)  
ID

CWE-408: Incorrect Behavior Order: Early Amplification

Weakness ID: 408
Abstraction: Base
Status: Draft
Presentation Filter:
+ Description

Description Summary

The software allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
+ Time of Introduction
  • Architecture and Design
  • Implementation
+ Applicable Platforms

Languages

All

+ Common Consequences
ScopeEffect
Availability

Technical Impact: DoS: amplification; DoS: crash / exit / restart; DoS: resource consumption (CPU); DoS: resource consumption (memory)

System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

+ Demonstrative Examples

Example 1

This data prints the contents of a specified file requested by a user.

(Bad Code)
Example Language: PHP 
function printFile($username,$filename){
//read file into string
$file = file_get_contents($filename);
if ($file && isOwnerOf($username,$filename)){
echo $file;
return true;
}
else{
echo 'You are not authorized to view this file';
}
return false;
}

This code first reads a specified file into memory, then prints the file if the user is authorized to see its contents. The read of the file into memory may be resource intensive and is unnecessary if the user is not allowed to see the file anyway.

+ Observed Examples
ReferenceDescription
Tool creates directories before authenticating user.
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class405Asymmetric Resource Consumption (Amplification)
Development Concepts (primary)699
Research Concepts1000
ChildOfWeakness ClassWeakness Class696Incorrect Behavior Order
Research Concepts (primary)1000
ChildOfCategoryCategory840Business Logic Errors
Development Concepts699
ChildOfCategoryCategory977SFP Secondary Cluster: Design
Software Fault Pattern (SFP) Clusters (primary)888
MemberOfViewView884CWE Cross-section
CWE Cross-section (primary)884
+ Relationship Notes

Overlaps authentication errors.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVEREarly Amplification
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time_of_Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Other_Notes, Taxonomy_Mappings
2009-05-27CWE Content TeamMITREInternal
updated Description
2010-06-21CWE Content TeamMITREInternal
updated Other_Notes, Relationship_Notes
2011-03-29CWE Content TeamMITREInternal
updated Demonstrative_Examples, Observed_Examples, Relationships
2011-06-01CWE Content TeamMITREInternal
updated Common_Consequences
2012-05-11CWE Content TeamMITREInternal
updated Common_Consequences, Relationships
2014-07-30CWE Content TeamMITREInternal
updated Relationships
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Early Amplification

More information is available — Please select a different filter.
Page Last Updated: May 05, 2017