CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How it's found
Uncontrolled Recursion describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
Vulnerable vs. safe
... // Do some real work here, but the value of flg is unmodifiedif (flg) { do_something_recursive (flg); } // flg is never modified so it is always TRUE - this call will continue until the stack explodesvoid do_something_recursive (int flg){}int flag = 1; // Set to TRUEdo_something_recursive (flag);... // Do some real work here// Modify value of flg on done conditionif (flg) { do_something_recursive (flg); } // returns when flg changes to 0void do_something_recursive (int flg){}int flag = 1; // Set to TRUEdo_something_recursive (flag);Consequences
- DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory): Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
- Read Application Data: In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.
Mitigations
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-674?
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How do you find Uncontrolled Recursion?
Uncontrolled Recursion describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-674?
DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory): Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash. Read Application Data: In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.
Does TurboPentest test for Uncontrolled Recursion?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
- Class weaknessCWE-834: Excessive Iteration
- Variant weaknessCWE-48: Path Equivalence: 'file name' (Internal Whitespace)
- Base weaknessCWE-170: Improper Null Termination
- Base weaknessCWE-369: Divide By Zero
- Variant weaknessCWE-382: J2EE Bad Practices: Use of System.exit()
- Class weaknessCWE-400: Uncontrolled Resource Consumption
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest