CWEweakness
CWE-431 Missing Handler
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
A handler is not available or implemented.
Extended description
When an exception is thrown and not caught, the process has given up an opportunity to decide if a given failure or event is worth a change in execution.
Common consequences
• Other: Varies by Context
Potential mitigations
• [Implementation] Handle all possible situations (e.g. error condition).
• [Implementation] If an operation can throw an Exception, implement a handler for that specific exception.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2022-25302: SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a cast fails, allowing for a crash
Related
Observed example · CVE (1)
- CVE-2022-25302 All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when… vulnerability
Can precede · CWE (1)
- CWE-433 Unparsed Raw Web Content Delivery weakness
Child of · CWE (1)
- CWE-691 Insufficient Control Flow Management weakness
Referenced by CVE · weakness (2)
- CVE-2024-4775 An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and… vulnerability
- CVE-2021-40334 Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker… vulnerability