What is Function Call With Incorrectly Specified (CWE-687)?

TL;DR: Function Call With Incorrectly Specified Argument Value (CWE-687) is a security weakness where incorrect values are passed to functions, compromising system integrity. Fix by ensuring proper parameter validation.

What is Function Call With Incorrectly Specified Argument Value?

Function Call With Incorrectly Specified Argument Value (CWE-687) is a type of security weakness that occurs when incorrect values are passed to functions, procedures, or routines. As defined by the MITRE Corporation under CWE-687.

Quick Summary

Function Call With Incorrectly Specified Argument Value can lead to resultant weaknesses compromising system integrity and quality, affecting software reliability and maintainability. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Function Call With Incorrectly Specified Argument Value Overview · How Function Call With Incorrectly Specified Argument Value Works · Business Impact of Function Call With Incorrectly Specified Argument Value · Function Call With Incorrectly Specified Argument Value Attack Scenario · How to Detect Function Call With Incorrectly Specified Argument Value · How to Fix Function Call With Incorrectly Specified Argument Value · Framework-Specific Fixes for Function Call With Incorrectly Specified Argument Value · How to Ask AI to Check Your Code for Function Call With Incorrectly Specified Argument Value · Function Call With Incorrectly Specified Argument Value Best Practices Checklist · Function Call With Incorrectly Specified Argument Value FAQ · Vulnerabilities Related to Function Call With Incorrectly Specified Argument Value · References · Scan Your Own Site

Function Call With Incorrectly Specified Argument Value Overview

What

Function Call With Incorrectly Specified Argument Value is a security weakness where incorrect values are passed to functions, procedures, or routines.

Why it matters

This vulnerability can lead to resultant weaknesses compromising system integrity and quality, affecting software reliability and maintainability.

Where it occurs

It occurs in any programming language when function calls are made with incorrect argument values.

Who is affected

Developers and organizations using languages that do not enforce strict parameter validation or defensive coding practices.

Who is NOT affected

Systems already employing robust parameter validation mechanisms and defensive programming techniques.

How Function Call With Incorrectly Specified Argument Value Works

Root Cause

Incorrect values are passed to functions, procedures, or routines due to a lack of proper argument validation.

Attack Flow

1. The attacker identifies a function call with incorrect arguments.
2. Exploits the vulnerability by passing malicious input.
3. Resultant weaknesses compromise system integrity and quality.

Prerequisites to Exploit

• Function calls must be made with incorrect argument values.
• Lack of strict parameter validation in place.

Vulnerable Code

def process_data(data):
    # Incorrectly specified argument value
    result = some_function(data, "incorrect_value")

process_data(user_input)

This code is vulnerable because it passes an incorrect value to some_function.

Secure Code

def process_data(data):
    # Correct and expected argument values
    result = some_function(data, correct_value)

process_data(user_input)

The secure version ensures that only correct and expected argument values are passed.

Business Impact of Function Call With Incorrectly Specified Argument Value

Quality Degradation

• Confidentiality: Exposure of sensitive data due to incorrect function calls.
• Integrity: Modification or corruption of system integrity due to improper input handling.
• Availability: Disruption of service availability when critical functions fail.

Real-world Consequences

• Financial losses from compromised systems and data breaches.
• Non-compliance with regulatory requirements leading to penalties.
• Damage to reputation and loss of customer trust.

Function Call With Incorrectly Specified Argument Value Attack Scenario

1. Attacker identifies a function call with incorrect arguments in the application code.
2. Exploits this vulnerability by passing malicious input to trigger unexpected behavior.
3. Resultant weaknesses compromise system integrity, leading to data corruption or leakage.

How to Detect Function Call With Incorrectly Specified Argument Value

Manual Testing

• Review all function calls for incorrect argument values.
• Ensure strict parameter validation is in place.
• Test edge cases and boundary conditions thoroughly.

Automated Scanners (SAST / DAST)

Static analysis tools can detect potential issues, while dynamic testing verifies actual runtime behavior.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap can identify Function Call With Incorrectly Specified Argument Value vulnerabilities.

False Positive Guidance

A real finding will show incorrect values being passed to functions, while a false alarm may indicate benign cases of strict parameter validation in place.

How to Fix Function Call With Incorrectly Specified Argument Value

• Ensure all function calls include correct and expected argument values.
• Implement strict parameter validation before calling functions.
• Use defensive programming techniques to handle unexpected inputs gracefully.

Framework-Specific Fixes for Function Call With Incorrectly Specified Argument Value

Python/Django

def process_data(data):
    # Correct and expected argument values
    result = some_function(data, correct_value)

process_data(user_input)

Java

public void processData(String data) {
    // Correct and expected argument values
    someFunction(data, "correctValue");
}

processData(userInput);

How to Ask AI to Check Your Code for Function Call With Incorrectly Specified Argument Value

Function Call With Incorrectly Specified Argument Value Best Practices Checklist

✅ Ensure all function calls include correct and expected argument values. ✅ Implement strict parameter validation before calling functions. ✅ Use defensive programming techniques to handle unexpected inputs gracefully. ✅ Test edge cases and boundary conditions thoroughly. ✅ Conduct regular code reviews for potential issues.

Function Call With Incorrectly Specified Argument Value FAQ

How does a function call with incorrectly specified argument value occur?

A function call with incorrectly specified argument values happens when the caller provides an incorrect or unexpected value to a function, procedure, or routine.

Why is Function Call With Incorrectly Specified Argument Value considered a security weakness?

It can lead to resultant weaknesses that compromise system integrity and quality, affecting software reliability and maintainability.

Can you provide real-world examples of how this vulnerability manifests in code?

Real-world examples include passing incorrect values for critical parameters such as file paths or configuration settings, leading to unexpected behavior or security issues.

How can developers detect Function Call With Incorrectly Specified Argument Value vulnerabilities in their applications?

Developers can use static analysis tools and manual testing techniques to identify instances where function calls are made with incorrect argument values.

What steps should be taken to fix Function Call With Incorrectly Specified Argument Value issues?

Ensure that all function calls include correct and expected argument values, validate input parameters before calling functions, and use defensive programming practices.

How can AI assist in identifying Function Call With Incorrectly Specified Argument Value vulnerabilities during code reviews?

AI tools can analyze code for patterns indicative of incorrect argument values being passed to functions, helping identify potential issues early on.

What are the best practices for preventing Function Call With Incorrectly Specified Argument Value weaknesses?

Implement strict parameter validation, use defensive programming techniques, and conduct thorough testing before deployment.

Vulnerabilities Related to Function Call With Incorrectly Specified Argument Value

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Function Call With Incorrectly Specified Argument Value and other risks before an attacker does.