What is Incorrect Conversion between Numeric (CWE-681)?

TL;DR: Incorrect Conversion between Numeric Types (CWE-681) is a vulnerability that occurs when converting data from one numeric type to another, leading to unexpected values. To fix it, avoid making conversions between numeric types and always check for allowed ranges.

What is Incorrect Conversion between Numeric Types?

Incorrect Conversion between Numeric Types (CWE-681) is a type of vulnerability that occurs when converting data from one numeric type to another, leading to unexpected values. As defined by the MITRE Corporation under CWE-681, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Incorrect Conversion between Numeric Types can lead to quality degradation and unexpected program states, affecting resource allocation and security decisions. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Incorrect Conversion between Numeric Types Overview · How Incorrect Conversion between Numeric Types Works · Business Impact of Incorrect Conversion between Numeric Types · Incorrect Conversion between Numeric Types Attack Scenario · How to Detect Incorrect Conversion between Numeric Types · How to Fix Incorrect Conversion between Numeric Types · Framework-Specific Fixes for Incorrect Conversion between Numeric Types · How to Ask AI to Check Your Code for Incorrect Conversion between Numeric Types · Incorrect Conversion between Numeric Types Best Practices Checklist · Incorrect Conversion between Numeric Types FAQ · Vulnerabilities Related to Incorrect Conversion between Numeric Types · References · Scan Your Own Site

Incorrect Conversion between Numeric Types Overview

What

Incorrect Conversion between Numeric Types is a vulnerability that occurs when converting data from one numeric type to another, leading to unexpected values.

Why it matters

This can cause quality degradation and unexpected program states, affecting resource allocation and security decisions.

Where it occurs

It commonly occurs in any programming language where numeric types are used.

Who is affected

Developers using languages with different numeric data types (e.g., Java, C++, Python).

Who is NOT affected

Systems that avoid converting between numeric types or strictly enforce type safety.

How Incorrect Conversion between Numeric Types Works

Root Cause

The root cause of CWE-681 is the loss of precision or range issues when converting from one data type to another.

Attack Flow

1. An attacker inputs a value that exceeds the target type’s maximum limit.
2. The system performs an incorrect conversion, resulting in unexpected values.
3. These values are used in sensitive contexts, leading to dangerous behaviors.

Prerequisites to Exploit

• A numeric value exceeding the range of the target data type.
• Lack of proper validation or range checks before conversion.

Vulnerable Code

def convert_to_int(value):
    return int(value)

This code is vulnerable because it converts a long integer to an integer without checking if the value fits within the range of the target type.

Secure Code

import sys

def safe_convert_to_int(value):
    max_val = sys.maxsize
    min_val = -sys.maxsize - 1
    
    if value > max_val or value < min_val:
        raise ValueError("Value out of range")
    
    return int(value)

This code is secure because it checks the input against the allowed range before performing the conversion.

Business Impact of Incorrect Conversion between Numeric Types

Integrity

• Example: Incorrectly converted values can lead to incorrect resource allocation.
• Consequence: Financial loss due to misallocation of resources.

Availability

• Example: Unexpected program states can cause system crashes or hangs.
• Consequence: Downtime and service interruptions leading to customer dissatisfaction.

Incorrect Conversion between Numeric Types Attack Scenario

1. An attacker inputs a large integer value into the application.
2. The application attempts to convert this value to an integer without range checks.
3. The conversion fails, resulting in unexpected values being used in sensitive contexts.
4. This leads to incorrect resource allocation or security decisions.

How to Detect Incorrect Conversion between Numeric Types

Manual Testing

• Check for type conversions and validate input ranges before conversion.
• Review code for potential loss of precision during numeric type conversions.
• Test edge cases where values exceed the target data type’s range.

Automated Scanners (SAST / DAST)

Static analysis can identify potential issues by looking for type conversions, while dynamic testing checks runtime behavior and actual values.

PenScan Detection

PenScan uses ZAP, Nuclei, Wapiti, Nikto to detect incorrect numeric type conversion vulnerabilities.

False Positive Guidance

A false positive occurs when the code performs a valid conversion without any security implications. Ensure that the context is secure before marking it as an issue.

How to Fix Incorrect Conversion between Numeric Types

• Avoid making conversions between numeric types where possible.
• Always check for allowed ranges before performing typecasts.
• Use wider data types or checked arithmetic functions when necessary.
• Implement proper validation and error handling for numeric conversions.

Framework-Specific Fixes for Incorrect Conversion between Numeric Types

Python (Django)

def safe_convert_to_int(value):
    max_val = sys.maxsize
    min_val = -sys.maxsize - 1
    
    if value > max_val or value < min_val:
        raise ValueError("Value out of range")
    
    return int(value)

Java

public static long safeConvertToLong(String value) {
    try {
        long num = Long.parseLong(value);
        if (num > Integer.MAX_VALUE || num < Integer.MIN_VALUE) {
            throw new IllegalArgumentException("Value out of range");
        }
        return (int) num;
    } catch (NumberFormatException e) {
        throw new IllegalArgumentException("Invalid input", e);
    }
}

Node.js

function safeConvertToInt(value) {
    const maxVal = Number.MAX_SAFE_INTEGER;
    const minVal = Number.MIN_SAFE_INTEGER;

    if (value > maxVal || value < minVal) {
        throw new Error('Value out of range');
    }

    return Math.trunc(value);
}

PHP

function safeConvertToInt($value) {
    $maxVal = PHP_INT_MAX;
    $minVal = PHP_INT_MIN;

    if ($value > $maxVal || $value < $minVal) {
        throw new Exception('Value out of range');
    }

    return (int)$value;
}

How to Ask AI to Check Your Code for Incorrect Conversion between Numeric Types

Incorrect Conversion between Numeric Types Best Practices Checklist

• ✅ Avoid making conversions between numeric types where possible.
• ✅ Always check for allowed ranges before performing typecasts.
• ✅ Use wider data types or checked arithmetic functions when necessary.
• ✅ Implement proper validation and error handling for numeric conversions.
• ✅ Test edge cases to ensure correct behavior under extreme conditions.

Incorrect Conversion between Numeric Types FAQ

How does incorrect conversion between numeric types occur?

It happens when data is converted from one numeric type to another, leading to unexpected values due to loss of precision or range issues.

What are the consequences of CWE-681 vulnerabilities?

Incorrect conversions can lead to quality degradation and unexpected program states, affecting resource allocation and security decisions.

How can developers prevent incorrect conversion between numeric types?

Developers should avoid making type conversions where possible and always check for allowed ranges before performing any typecasts.

What are the common programming mistakes that cause CWE-681?

Common mistakes include converting large integers to smaller types without checking if they fit within the range of the target type.

How do automated scanners detect incorrect conversion between numeric types?

static analysis can identify potential issues by looking for type conversions, while dynamic testing checks runtime behavior and actual values.

What are some real-world examples of CWE-681 vulnerabilities?

Examples include converting a long to an integer without range checking or using floating-point numbers in critical calculations.

How can I use AI to check my code for incorrect conversion between numeric types?

You can ask an AI assistant to review your code and suggest fixes based on CWE-681 guidelines.

Vulnerabilities Related to Incorrect Conversion between Numeric Types

References

• MITRE - CWE-681
• NVD - National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Incorrect Conversion between Numeric Types and other risks before an attacker does.