What is Incorrect Check of Function Return Value (CWE-253)?

TL;DR: Incorrect Check of Function Return Value (CWE-253) occurs when a product incorrectly checks the return value from a function, preventing it from detecting errors or exceptional conditions.

What is Incorrect Check of Function Return Value?

Incorrect Check of Function Return Value (CWE-253) is a type of vulnerability that occurs when a product incorrectly checks the return value from a function, preventing it from detecting errors or exceptional conditions. As defined by the MITRE Corporation under CWE-253, and classified by the OWASP Foundation as not directly mapped, this vulnerability can lead to unexpected states, crashes, or other unintended behaviors due to incorrect return value checks.

Quick Summary

Incorrect Check of Function Return Value (CWE-253) is a critical security issue that occurs when a product incorrectly checks the return value from a function. This can lead to unexpected states, crashes, or other unintended behaviors due to incorrect return value checks. To prevent CWE-253, ensure that all functions returning error codes are properly checked for their return values.

Jump to: Quick Summary · Incorrect Check of Function Return Value Overview · How Incorrect Check of Function Return Value Works · Business Impact of Incorrect Check of Function Return Value · Incorrect Check of Function Return Value Attack Scenario · How to Detect Incorrect Check of Function Return Value · How to Fix Incorrect Check of Function Return Value · Framework-Specific Fixes for Incorrect Check of Function Return Value · How to Ask AI to Check Your Code for Incorrect Check of Function Return Value · Incorrect Check of Function Return Value Best Practices Checklist · Incorrect Check of Function Return Value FAQ · Vulnerabilities Related to Incorrect Check of Function Return Value · References · Scan Your Own Site

Incorrect Check of Function Return Value Overview

What

Incorrect Check of Function Return Value (CWE-253) is a type of vulnerability that occurs when a product incorrectly checks the return value from a function.

Why it matters

CWE-253 can lead to unexpected states, crashes, or other unintended behaviors due to incorrect return value checks. It is essential to properly check the return values of functions that may return error codes to prevent this vulnerability.

Where it occurs

CWE-253 typically occurs when a function returns an error code that is not properly checked by the calling code.

Who is affected

Any product or application that uses functions returning error codes can be affected by CWE-253.

Who is NOT affected

Applications that never construct paths/queries/commands from external input and systems already using exception-based error handling are less likely to be affected by CWE-253.

How Incorrect Check of Function Return Value Works

Root Cause

The root cause of CWE-253 is the incorrect checking of return values from functions, which prevents the product from detecting errors or exceptional conditions.

Attack Flow

1. A function returns an error code.
2. The calling code does not properly check the return value.
3. The product continues to execute with the incorrect assumption that no error occurred.

Prerequisites to Exploit

• The function must return an error code.
• The calling code must not properly check the return value.

Vulnerable Code

def read_file(file_path):
    try:
        with open(file_path, 'r') as file:
            content = file.read()
        return content
    except Exception as e:
        # Incorrectly returning an error code without checking it
        return 1

file_content = read_file('example.txt')
if file_content == 1:  # Incorrect check of return value
    print("Error occurred")
else:
    print(file_content)

Secure Code

def read_file(file_path):
    try:
        with open(file_path, 'r') as file:
            content = file.read()
        return content
    except Exception as e:
        # Properly checking and handling the error code
        if isinstance(e, FileNotFoundError):
            print("Error: File not found")
            return None

file_content = read_file('example.txt')
if file_content is None:
    print("Error: File not found")
else:
    print(file_content)

Business Impact of Incorrect Check of Function Return Value

Confidentiality

• CWE-253 can lead to unauthorized access or disclosure of sensitive data.

Integrity

• CWE-253 can result in modification or tampering with critical systems or data.

Availability

• CWE-253 can cause system crashes, downtime, or other availability issues.

Some real-world business consequences include:

• Financial losses due to system downtime or data breaches.
• Compliance and regulatory issues resulting from unauthorized access or data modification.
• Reputation damage due to security incidents.

Incorrect Check of Function Return Value Attack Scenario

1. An attacker attempts to access a sensitive file on the server.
2. The function returns an error code indicating that the file is not accessible.
3. The calling code does not properly check the return value, assuming that no error occurred.
4. The product continues to execute with the incorrect assumption, allowing the attacker to access the sensitive file.

How to Detect Incorrect Check of Function Return Value

Manual Testing

• Review code for incorrect checks of return values from functions.
• Test functions returning error codes to ensure proper checking and handling.

Automated Scanners (SAST / DAST)

• Static analysis tools can detect incorrect checks of return values in code.
• Dynamic analysis tools can test functions returning error codes to ensure proper checking and handling.

PenScan Detection

PenScan’s automated scan engines actively test for CWE-253, ensuring you catch it before an attacker does.

False Positive Guidance

When reviewing findings from static or dynamic analysis tools, consider the following:

• Incorrect checks of return values may be due to legitimate code patterns.
• Ensure that the tool is configured correctly and has access to all relevant code.

How to Fix Incorrect Check of Function Return Value

To fix CWE-253, ensure that all functions returning error codes are properly checked for their return values. This can be achieved by:

• Implementing exception-based error handling.
• Properly checking and handling error codes in calling code.
• Reviewing and testing code for incorrect checks of return values.

Framework-Specific Fixes for Incorrect Check of Function Return Value

Java

public class FileReader {
    public String read(String file_path) throws Exception {
        try (FileInputStream fis = new FileInputStream(file_path)) {
            // Properly checking and handling the error code
            if (fis.available() == 0) {
                throw new FileNotFoundException("File not found");
            }
            return new BufferedReader(new InputStreamReader(fis)).readLine();
        } catch (Exception e) {
            // Handling other exceptions
            System.out.println("Error: " + e.getMessage());
            return null;
        }
    }
}

Node.js

const fs = require('fs');

function read_file(file_path, callback) {
    try {
        const content = fs.readFileSync(file_path);
        // Properly checking and handling the error code
        if (content === undefined || content.length === 0) {
            throw new Error("File not found");
        }
        callback(null, content.toString());
    } catch (err) {
        // Handling other exceptions
        console.error('Error:', err.message);
        callback(err);
    }
}

Python/Django

from django.core.files.base import File

def read_file(file_path):
    try:
        with open(file_path, 'r') as file:
            content = file.read()
        # Properly checking and handling the error code
        if not content:
            raise FileNotFoundError("File not found")
        return content
    except Exception as e:
        # Handling other exceptions
        print("Error:", e)
        return None

PHP

function read_file($file_path) {
    try {
        $content = file_get_contents($file_path);
        // Properly checking and handling the error code
        if ($content === false || strlen($content) === 0) {
            throw new Exception("File not found");
        }
        return $content;
    } catch (Exception $e) {
        // Handling other exceptions
        echo "Error: " . $e->getMessage() . "\n";
        return null;
    }
}

How to Ask AI to Check Your Code for Incorrect Check of Function Return Value

Review the following code block for potential CWE-253 Incorrect Check of Function Return Value vulnerabilities and rewrite it using exception-based error handling:

def read_file(file_path):
    try:
        with open(file_path, 'r') as file:
            content = file.read()
        return content
    except Exception as e:
        # Incorrectly returning an error code without checking it
        return 1

file_content = read_file('example.txt')
if file_content == 1:  # Incorrect check of return value
    print("Error occurred")
else:
    print(file_content)

Incorrect Check of Function Return Value Best Practices Checklist

✅ Properly check and handle error codes returned by functions. ✅ Implement exception-based error handling for critical systems or data. ✅ Review and test code for incorrect checks of return values.

Incorrect Check of Function Return Value FAQ

How is CWE-253 related to OWASP Security Misconfiguration?

There is no official mapping between CWE-253 and OWASP Security Misconfiguration.

What are the potential consequences of CWE-253?

CWE-253 can lead to unexpected states, crashes, or other unintended behaviors due to incorrect return value checks.

How does CWE-253 occur in real-world scenarios?

CWE-253 typically occurs when a function returns an error code that is not properly checked by the calling code.

What are some common frameworks affected by CWE-253?

CWE-253 can affect various programming languages and frameworks, including Java, Python, C++, and JavaScript.

How can I prevent CWE-253 in my application?

To prevent CWE-253, ensure that all functions returning error codes are properly checked for their return values.

Can CWE-253 be detected using automated tools?

Yes, CWE-253 can be detected using automated tools and scan engines like PenScan.

How do I fix CWE-253 in my code?

To fix CWE-253, properly check the return values of functions that may return error codes.

Vulnerabilities Related to Incorrect Check of Function Return Value

References

• MITRE CWE-253
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find CWE-253 and other risks before an attacker does.