CWE-1389: Incorrect Parsing of Numbers with Different Radices

Description

The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).

Frequently, a numeric input that begins with "0" is treated as octal, or "0x" causes it to be treated as hexadecimal, e.g. by the inet_addr() function. For example, "023" (octal) is 35 decimal, or "0x31" is 49 decimal. Other bases may be used as well. If the developer assumes decimal-only inputs, the code could produce incorrect numbers when the inputs are parsed using a different base. This can result in unexpected and/or dangerous behavior. For example, a "0127.0.0.1" IP address is parsed as octal due to the leading "0", whose numeric value would be the same as 87.0.0.1 (decimal), where the developer likely expected to use 127.0.0.1. The consequences vary depending on the surrounding code in which this weakness occurs, but they can include bypassing network-based access control using unexpected IP addresses or netmasks, or causing apparently-symbolic identifiers to be processed as if they are numbers. In web applications, this can enable bypassing of SSRF restrictions.

Potential Impact

Demonstrative Examples

import subprocess
					  
					  def validate_ip(ip: str):
					  
					    split_ip = ip.split('.')
						if len(split_ip) > 4 or len(split_ip) == 0:
						
						  raise ValueError("Invalid IP length")
						
						
						for octet in split_ip:
						
						  try:
						  
						    int(octet, 10)
						  
						  except ValueError as e:
						  
						    raise ValueError(f"Cannot convert IP octet to int - {e}")
						  
						
						
						# Returns original IP after ensuring no exceptions are raised
						return ip

					  
					  
					  def run_ping(ip: str):
					  
					    validated = validate_ip(ip)
						# The ping command treats zero-prepended IP addresses as octal
						result = subprocess.call(["ping", validated])
						print(result)

import subprocess
					  import re
					  
					  def validate_ip_regex(ip: str):
					  
					    ip_validator = re.compile(r"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}")
						if ip_validator.match(ip):
						
						  return ip
						
						else:
						
						  raise ValueError("IP address does not match valid pattern.")
						
					  
					
					def run_ping_regex(ip: str):
				      
						validated = validate_ip_regex(ip)
						# The ping command treats zero-prepended IP addresses as octal
						result = subprocess.call(["ping", validated])
						print(result)

taki.example.com 10.1.0.7
					  night.example.com 010.1.0.8

Mitigations & Prevention

Detection Methods

• Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses