Description
The code does not have a default case in an expression with multiple conditions, such as a switch statement.
If a multiple-condition expression (such as a switch in C) omits the default case but does not consider or handle all possible values that could occur, then this might lead to complex logical errors and resultant weaknesses. Because of this, further decisions are made based on poor information, and cascading failure results. This cascading failure may result in any number of security issues, and constitutes a significant failure in the system.
Potential Impact
Integrity
Varies by Context, Alter Execution Logic
Demonstrative Examples
#define FAILED 0#define PASSED 1int result;...result = security_check(data);switch (result) {
case FAILED:printf("Security check failed!\n");exit(-1);
//Break never reached because of exit()
break;
case PASSED:printf("Security check passed.\n");break;
}
// program execution continues...
...#define FAILED 0#define PASSED 1int result;...result = security_check(data);switch (result) {
case FAILED:printf("Security check failed!\n");exit(-1);
//Break never reached because of exit()
break;
case PASSED:printf("Security check passed.\n");break;
default:printf("Unknown error (%d), exiting...\n",result);exit(-1);
}public static final String INTEREST_RATE_AT_ZERO_POINTS = "5.00";public static final String INTEREST_RATE_AT_ONE_POINTS = "4.75";public static final String INTEREST_RATE_AT_TWO_POINTS = "4.50";...public BigDecimal getInterestRate(int points) {
BigDecimal result = new BigDecimal(INTEREST_RATE_AT_ZERO_POINTS);
switch (points) {
case 0:result = new BigDecimal(INTEREST_RATE_AT_ZERO_POINTS);break;
case 1:result = new BigDecimal(INTEREST_RATE_AT_ONE_POINTS);break;
case 2:result = new BigDecimal(INTEREST_RATE_AT_TWO_POINTS);break;
}return result;
}public static final String INTEREST_RATE_AT_ZERO_POINTS = "5.00";public static final String INTEREST_RATE_AT_ONE_POINTS = "4.75";public static final String INTEREST_RATE_AT_TWO_POINTS = "4.50";...public BigDecimal getInterestRate(int points) {
BigDecimal result = new BigDecimal(INTEREST_RATE_AT_ZERO_POINTS);
switch (points) {
case 0:result = new BigDecimal(INTEREST_RATE_AT_ZERO_POINTS);break;
case 1:result = new BigDecimal(INTEREST_RATE_AT_ONE_POINTS);break;
case 2:result = new BigDecimal(INTEREST_RATE_AT_TWO_POINTS);break;
default:System.err.println("Invalid value for points, must be 0, 1 or 2");System.err.println("Returning null value for interest rate");result = null;
}
return result;
}result = process_data(data)
match result:
case 0:
print("Properly handle zero case.")
case 1:
print("Properly handle one case.")
# program execution continues...result = process_data(data)
match result:
case 0:
print("Properly handle zero case.")
case 1:
print("Properly handle one case.")
case _:
print("Properly handle unexpected condition.")
# program execution continues...let step = input1 + input2;
switch(step) {
case 1:
alert("Process step 1.");
break;
case 2:
alert("Process step 2.");
break;
case 3:
alert("Process step 3.");
break;
}
// program execution continues...let step = input1 + input2;
switch(step) {
case 1:
alert("Process step 1.");
break;
case 2:
alert("Process step 2.");
break;
case 3:
alert("Process step 3.");
break;
default:
alert("Unexpected step encountered.");
}
// program execution continues...Mitigations & Prevention
Ensure that there are no cases unaccounted for when adjusting program flow or values based on the value of a given variable. In the case of switch style statements, the very simple act of creating a default case can, if done correctly, mitigate this situation. Often however, the default case is used simply to represent an assumed option, as opposed to working as a check for invalid input. This is poor practice and in some cases is as bad as omitting a default case entirely.
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Related Weaknesses
Taxonomy Mappings
- CLASP: — Failure to account for default case in switch
- Software Fault Patterns: SFP4 — Unchecked Status Condition
Frequently Asked Questions
What is CWE-478?
CWE-478 (Missing Default Case in Multiple Condition Expression) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The code does not have a default case in an expression with multiple conditions, such as a switch statement.
How can CWE-478 be exploited?
Attackers can exploit CWE-478 (Missing Default Case in Multiple Condition Expression) to varies by context, alter execution logic. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-478?
Key mitigations include: Ensure that there are no cases unaccounted for when adjusting program flow or values based on the value of a given variable. In the case of switch style statements, the very simple act of creating a d
What is the severity of CWE-478?
CWE-478 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.