CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
How it's found
Operation on a Resource after Expiration or Release describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
Vulnerable vs. safe
result = ERROR;free(messageBody);messageBody = (char*)malloc(length*sizeof(char));messageBody = &message[1][0];int success = processMessageBody(messageBody);if (success == ERROR) {}
printf("Unable to process message; invalid message length");result = FAIL;
logError("Error processing message", messageBody);int result = SUCCESS;int length = getMessageLength(message[0]);char *messageBody;if ((length > 0) && (length < MAX_MESSAGE_SIZE)) {}else {}if (result == ERROR) {}return result;#define FAIL 0#define SUCCESS 1#define ERROR -1#define MAX_MESSAGE_SIZE 32int processMessage(char **message){}result = ERROR;logError("Error processing message", messageBody);free(messageBody);...messageBody = (char*)malloc(length*sizeof(char));messageBody = &message[1][0];int success = processMessageBody(messageBody);if (success == ERROR) {}...Consequences
- Modify Application Data, Read Application Data: If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.
- Other, DoS: Crash, Exit, or Restart: When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-672?
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
How do you find Operation on a Resource after Expiration or Release?
Operation on a Resource after Expiration or Release describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-672?
Modify Application Data, Read Application Data: If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity. Other, DoS: Crash, Exit, or Restart: When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.
Does TurboPentest test for Operation on a Resource after Expiration or Release?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest