CWE-684: Incorrect Provision of Specified Functionality

Description

The code does not function according to its published specifications, potentially leading to incorrect usage.

When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.

Potential Impact

Other

Quality Degradation

Demonstrative Examples

In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even if an error occurs.

Bad

try {
                        
                           
                           // Something that may throw an exception.
                           ...
                     } catch (Throwable t) {logger.error("Caught: " + t.toString());return;}

In the following example, an HTTP 404 status code is returned in the event of an IOException encountered in a Java servlet. A 404 code is typically meant to indicate a non-existent resource and would be somewhat misleading in this case.

Bad

try {
                        
                           
                           // something that might throw IOException
                           ...
                     } catch (IOException ioe) {response.sendError(SC_NOT_FOUND);}

Mitigations & Prevention

Implementation

Ensure that your code strictly conforms to specifications.

Real-World CVE Examples

CVE ID	Description
CVE-2002-1446	Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.
CVE-2001-1559	Chain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476).
CVE-2003-0187	Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.
CVE-1999-1446	UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.

Taxonomy Mappings

CERT C Secure Coding: PRE09-C — Do not replace secure functions with less secure functions

Frequently Asked Questions

What is CWE-684?

CWE-684 (Incorrect Provision of Specified Functionality) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. The code does not function according to its published specifications, potentially leading to incorrect usage.

How can CWE-684 be exploited?

Attackers can exploit CWE-684 (Incorrect Provision of Specified Functionality) to quality degradation. This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-684?

Key mitigations include: Ensure that your code strictly conforms to specifications.

What is the severity of CWE-684?

CWE-684 is classified as a Class-level weakness (High abstraction). It has been observed in 4 real-world CVEs.