What is Unchecked Return Value (CWE-252)?

TL;DR: Unchecked Return Value (CWE-252) is a critical vulnerability that occurs when an application fails to check the return value from a method or function. To fix it, you should check return values, verify input data, and use secure coding practices.

What is Unchecked Return Value?

Unchecked Return Value (CWE-252) is a type of A10:2025 - Mishandling of Exceptional Conditions vulnerability that occurs when an application fails to check the return value from a method or function. This can lead to unexpected states and conditions, including Denial-of-Service (DoS) attacks and crashes or restarts.

Quick Summary

Unchecked Return Value is a critical vulnerability that can have significant consequences for your application’s security and reliability. It occurs when an application fails to check the return value from a method or function, leading to unexpected states and conditions. To fix this vulnerability, you should check return values, verify input data, and use secure coding practices.

Jump to: Quick Summary · Unchecked Return Value Overview · How Unchecked Return Value Works · Business Impact of Unchecked Return Value · Unchecked Return Value Attack Scenario · How to Detect Unchecked Return Value · How to Fix Unchecked Return Value · Framework-Specific Fixes for Unchecked Return Value · How to Ask AI to Check Your Code for Unchecked Return Value · Unchecked Return Value Best Practices Checklist · Unchecked Return Value FAQ · Vulnerabilities Related to Unchecked Return Value · References · Scan Your Own Site

Unchecked Return Value Overview

What: Unchecked Return Value is a type of A10:2025 - Mishandling of Exceptional Conditions vulnerability that occurs when an application fails to check the return value from a method or function.

Why it matters: The consequences of Unchecked Return Value can include unexpected state changes, Denial-of-Service (DoS) attacks, and crashes or restarts. It is essential to detect and prevent this vulnerability to ensure the security and reliability of your application.

Where it occurs: Unchecked Return Value can occur in any application that uses methods or functions to perform operations.

Who is affected: Any application that fails to check return values from methods or functions is vulnerable to Unchecked Return Value.

How Unchecked Return Value Works

Root Cause

The root cause of Unchecked Return Value is the failure to check return values from methods or functions. This can lead to unexpected states and conditions, including Denial-of-Service (DoS) attacks and crashes or restarts.

Attack Flow

1. The attacker calls a method or function that returns an unexpected value.
2. The application fails to check the return value, leading to unexpected states and conditions.
3. The consequences of Unchecked Return Value can include Denial-of-Service (DoS) attacks and crashes or restarts.

Prerequisites to Exploit

• The attacker must have access to the method or function that returns an unexpected value.
• The application must fail to check return values from methods or functions.

Vulnerable Code

int read_file(char *filename) {
  FILE *file = fopen(filename, "r");
  if (file == NULL) {
    // Do nothing
  }
  fclose(file);
}

The vulnerable code above fails to check the return value of fopen(), which can lead to unexpected states and conditions.

Secure Code

int read_file(char *filename) {
  FILE *file = fopen(filename, "r");
  if (file == NULL) {
    // Handle error
  }
  fclose(file);
}

The secure code above checks the return value of fopen() and handles any errors that may occur.

Business Impact of Unchecked Return Value

Confidentiality: Unchecked Return Value can lead to unexpected state changes, which can compromise sensitive data.

Integrity: Unchecked Return Value can lead to Denial-of-Service (DoS) attacks, which can disrupt the integrity of your application.

Availability: Unchecked Return Value can lead to crashes or restarts, which can compromise the availability of your application.

Unchecked Return Value Attack Scenario

1. The attacker calls a method or function that returns an unexpected value.
2. The application fails to check the return value, leading to unexpected states and conditions.
3. The consequences of Unchecked Return Value can include Denial-of-Service (DoS) attacks and crashes or restarts.

How to Detect Unchecked Return Value

Manual Testing

• Review your code for methods or functions that return unexpected values.
• Test your application with various inputs to detect any unexpected behavior.

Automated Scanners (SAST/DAST)

• Use automated scanners to detect any potential vulnerabilities in your code.
• These scanners can help identify any issues related to Unchecked Return Value.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.
• You can use PenScan to detect and prevent Unchecked Return Value in your application.

False Positive Guidance

• Be cautious when reviewing the results of automated scans, as some issues may be false positives.
• Use manual testing and code reviews to verify any potential vulnerabilities detected by automated scanners.

How to Fix Unchecked Return Value

• Check return values from methods or functions.
• Verify input data to ensure it is valid and expected.
• Use secure coding practices to prevent unexpected states and conditions.

Framework-Specific Fixes for Unchecked Return Value

Java

public int read_file(String filename) {
  File file = new File(filename);
  if (file.exists()) {
    // Read file contents
  } else {
    // Handle error
  }
}

The secure code above checks the return value of File.exists() and handles any errors that may occur.

Node.js

const fs = require('fs');
function read_file(filename) {
  const file = fs.readFileSync(filename, 'utf8');
  if (file === null) {
    // Handle error
  }
}

The secure code above checks the return value of fs.readFileSync() and handles any errors that may occur.

Python/Django

import os
def read_file(filename):
  try:
    with open(filename, 'r') as file:
      contents = file.read()
  except FileNotFoundError:
    # Handle error

The secure code above checks the return value of open() and handles any errors that may occur.

PHP

function read_file($filename) {
  $file = fopen($filename, 'r');
  if ($file === false) {
    // Handle error
  }
}

The secure code above checks the return value of fopen() and handles any errors that may occur.

How to Ask AI to Check Your Code for Unchecked Return Value

You can use AI to check your code for Unchecked Return Value by providing a copy-pasteable prompt with the relevant language code block. For example:

Review the following Python code block for potential CWE-252 Unchecked Return Value vulnerabilities and rewrite it using secure coding practices: 
def read_file(filename):
  file = open(filename, 'r')
  if file == None:
    # Do nothing
  contents = file.read()

Unchecked Return Value Best Practices Checklist

✅ Check return values from methods or functions. ✅ Verify input data to ensure it is valid and expected. ✅ Use secure coding practices to prevent unexpected states and conditions.

Unchecked Return Value FAQ

How does Unchecked Return Value occur?

Unchecked Return Value occurs when an application fails to check the return value from a method or function, leading to unexpected states and conditions.

What are the consequences of Unchecked Return Value?

The consequences of Unchecked Return Value can include unexpected state changes, Denial-of-Service (DoS) attacks, and crashes or restarts.

How do I detect Unchecked Return Value in my application?

You can detect Unchecked Return Value using manual testing, automated scanners (SAST/DAST), PenScan detection, and code reviews.

What are the best practices for preventing Unchecked Return Value?

The best practices for preventing Unchecked Return Value include checking return values from methods or functions, verifying input data, and using secure coding practices.

Can I use AI to check my code for Unchecked Return Value?

Yes, you can use AI to check your code for Unchecked Return Value by providing a copy-pasteable prompt with the relevant language code block.

What are the related vulnerabilities to Unchecked Return Value?

The related vulnerabilities to Unchecked Return Value include CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-476 (NULL Pointer Dereference).

Vulnerabilities Related to Unchecked Return Value

References

• MITRE: CWE-252
• OWASP: A10:2025 - Mishandling of Exceptional Conditions
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Unchecked Return Value and other risks before an attacker does.