What is Incorrect Access of Indexable Resource (CWE-118)?

TL;DR: Incorrect Access of Indexable Resource (‘Range Error’) (CWE-118) occurs when a product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer. To fix it, implement robust input validation and restrict operations within resource boundaries.

At-a-Glance Table

What is Incorrect Access of Indexable Resource (‘Range Error’)?

Incorrect Access of Indexable Resource (‘Range Error’) (CWE-118) is a type of Security Misconfiguration vulnerability that occurs when a product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files. As defined by the MITRE Corporation under CWE-118, and classified by the OWASP Foundation under A09:2021 - Security Misconfiguration…

Quick Summary

Incorrect Access of Indexable Resource (‘Range Error’) (CWE-118) can lead to varying impacts depending on the context, including confidentiality, integrity, and availability issues. It’s essential to implement robust input validation, restrict operations within resource boundaries, and follow secure coding guidelines to prevent CWE-118 vulnerabilities.

Jump to: Quick Summary · Incorrect Access of Indexable Resource (‘Range Error’) Overview · How Incorrect Access of Indexable Resource (‘Range Error’) Works · Business Impact of Incorrect Access of Indexable Resource (‘Range Error’) · Incorrect Access of Indexable Resource (‘Range Error’) Attack Scenario · How to Detect Incorrect Access of Indexable Resource (‘Range Error’) · How to Fix Incorrect Access of Indexable Resource (‘Range Error’) · Framework-Specific Fixes for Incorrect Access of Indexable Resource (‘Range Error’) · How to Ask AI to Check Your Code for Incorrect Access of Indexable Resource (‘Range Error’) · Incorrect Access of Indexable Resource (‘Range Error’) Best Practices Checklist · Incorrect Access of Indexable Resource (‘Range Error’) FAQ · Vulnerabilities Related to Incorrect Access of Indexable Resource (‘Range Error’) · References · Scan Your Own Site

Incorrect Access of Indexable Resource (‘Range Error’) Overview

What

Incorrect Access of Indexable Resource (‘Range Error’) (CWE-118) occurs when a product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Why it matters

CWE-118 can lead to varying impacts depending on the context, including confidentiality, integrity, and availability issues. It’s essential to implement robust input validation, restrict operations within resource boundaries, and follow secure coding guidelines to prevent CWE-118 vulnerabilities.

Where it occurs

CWE-118 can occur in various contexts, including memory-safe languages (e.g., Rust), systems programming languages (C, C++), and frameworks that handle file paths/queries/command construction from external input.

Who is affected

Any product or system that does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer can be affected by CWE-118.

Who is NOT affected

Applications that never construct paths/queries/commands from external input, and systems already using robust input validation and secure coding practices are less likely to be affected by CWE-118.

How Incorrect Access of Indexable Resource (‘Range Error’) Works

Root Cause

The root cause of CWE-118 is the failure to restrict or incorrectly restrict operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Attack Flow

1. An attacker identifies a vulnerable resource that is accessed using an index or pointer.
2. The attacker manipulates the input to the resource, causing it to access an unintended location.
3. The product or system fails to restrict or incorrectly restricts operations within the boundaries of the resource, allowing the attacker to access sensitive data or perform unauthorized actions.

Prerequisites to Exploit

• The product or system must be using a memory-safe language (e.g., Rust) or systems programming languages (C, C++) that handle file paths/queries/command construction from external input.
• The attacker must have access to the vulnerable resource and be able to manipulate its input.

Vulnerable Code

def get_item(items, index):
    return items[index]

This code demonstrates a CWE-118 vulnerability: index comes directly from the caller with no bounds check, so a negative or too-large value lets an attacker read (or, on assignment, write) outside the list’s valid range.

Secure Code

def get_item(items, index):
    if 0 <= index < len(items):
        return items[index]
    raise IndexError(f"Index {index} out of range for resource of length {len(items)}")

This code demonstrates a secure implementation of CWE-118 by validating the index against the resource’s actual bounds before accessing it.

Business Impact of Incorrect Access of Indexable Resource (‘Range Error’)

Confidentiality

CWE-118 can lead to confidentiality issues, including unauthorized access to sensitive data or intellectual property.

Integrity

CWE-118 can also lead to integrity issues, including modification or deletion of critical system files or data.

Availability

CWE-118 can disrupt availability by causing the product or system to become unresponsive or crash due to unauthorized access or data modification.

Real-world business consequences include:

• Financial losses due to data breaches or intellectual property theft
• Compliance issues due to failure to protect sensitive data
• Reputation damage due to public disclosure of security vulnerabilities

Incorrect Access of Indexable Resource (‘Range Error’) Attack Scenario

1. An attacker identifies a vulnerable resource that is accessed using an index or pointer.
2. The attacker manipulates the input to the resource, causing it to access an unintended location.
3. The product or system fails to restrict or incorrectly restricts operations within the boundaries of the resource, allowing the attacker to access sensitive data or perform unauthorized actions.

How to Detect Incorrect Access of Indexable Resource (‘Range Error’)

Manual Testing

• Review code and configuration files for CWE-118 vulnerabilities
• Test input validation and secure coding practices
• Verify that operations are restricted within resource boundaries

Automated Scanners (SAST/DAST)

• Use SAST tools to identify CWE-118 vulnerabilities in source code
• Use DAST tools to identify CWE-118 vulnerabilities in runtime behavior

PenScan Detection

PenScan’s scanner engines actively test for CWE-118 vulnerabilities, including input validation and secure coding practices.

False Positive Guidance

To avoid false positives, ensure that the product or system is using robust input validation and secure coding practices. Also, verify that operations are restricted within resource boundaries.

How to Fix Incorrect Access of Indexable Resource (‘Range Error’)

• Implement robust input validation
• Restrict operations within resource boundaries
• Follow secure coding guidelines

Framework-Specific Fixes for Incorrect Access of Indexable Resource (‘Range Error’)

For memory-safe languages (e.g., Rust), use the std::fs module to handle file paths and queries. For systems programming languages (C, C++), use the open() function with proper error handling.

How to Ask AI to Check Your Code for Incorrect Access of Indexable Resource (‘Range Error’)

You can use a copy-pasteable prompt with an AI-powered coding assistant to review your code and suggest fixes for CWE-118 vulnerabilities:

Review the following Python code block for potential CWE-118 Incorrect Access of Indexable Resource ('Range Error') vulnerabilities and rewrite it using robust input validation:

Incorrect Access of Indexable Resource (‘Range Error’) Best Practices Checklist

✅ Implement robust input validation ✅ Restrict operations within resource boundaries ✅ Follow secure coding guidelines ✅ Use framework-specific fixes for CWE-118 ✅ Regularly review and update code to prevent CWE-118 vulnerabilities

Incorrect Access of Indexable Resource (‘Range Error’) FAQ

How does CWE-118 differ from CWE-664?

CWE-118 is a more specific variant of CWE-664, Improper Control of a Resource Through its Lifetime.

What are the common consequences of CWE-118?

The common consequences of CWE-118 include varying impacts depending on the context.

How can I detect CWE-118 in my code?

You can use manual testing, automated scanners (SAST/DAST), and PenScan detection to identify CWE-118 vulnerabilities.

What are some best practices for preventing CWE-118?

Implement robust input validation, restrict operations within resource boundaries, and follow secure coding guidelines.

Can AI help me detect CWE-118 in my code?

Yes, you can use AI-powered coding assistants to review your code and suggest fixes for CWE-118 vulnerabilities.

What are some common framework-specific fixes for CWE-118?

The specific fix depends on the framework or language being used, but generally involves implementing robust input validation and secure coding practices.

How can I ask AI to check my code for CWE-118?

You can use a copy-pasteable prompt with an AI-powered coding assistant to review your code and suggest fixes for CWE-118 vulnerabilities.

Vulnerabilities Related to Incorrect Access of Indexable Resource (‘Range Error’)

References

• MITRE CWE-118
• CAPEC-10, CAPEC-14, CAPEC-24, CAPEC-45, CAPEC-46, CAPEC-47, CAPEC-8, CAPEC-9
• NVD CVE Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Incorrect Access of Indexable Resource (‘Range Error’) and other risks before an attacker does.