CWE-839: Numeric Range Comparison Without Minimum Check
The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
How it's found
Numeric Range Comparison Without Minimum Check is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Some products use signed integers or floats even when their values are only expected to be positive or 0. An input validation check might assume that the value is positive, and only check for the maximum value. If the value is negative, but the code assumes that the value is positive, this can produce an error. The error may have security consequences if the negative value is used for memory allocation, array access, buffer access, etc. Ultimately, the error could lead to a buffer overflow or other type of memory corruption. The use of a negative number in a positive-only context could have security implications for other types of resources. For example, a shopping cart might check that the user is not requesting more than 10 items, but a request for -3 items could cause the application to calculate a negative price and credit the attacker's account.
Vulnerable vs. safe
// check that the array index is less than the maximum
// length of the array
// if array index is invalid then output error message
// and return value indicating error
// get the value at the specified index of the arrayvalue = array[index];
printf("Value is: %d\n", array[index]);value = -1;int value;if (index < len) {}else {}return value;int getValueFromArray(int *array, int len, int index) {}// check that the array index is within the correct
// range of values for the array...if (index >= 0 && index < len) {...Consequences
- Modify Application Data, Execute Unauthorized Code or Commands: An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
- DoS: Resource Consumption (Other): in some contexts, a negative value could lead to resource consumption.
- Modify Memory, Read Memory: If a negative value is used to access memory, buffers, or other indexable structures, it could access memory outside the bounds of the buffer.
Mitigations
- Implementation: If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.
- Implementation: If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-839?
The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
How do you find Numeric Range Comparison Without Minimum Check?
Numeric Range Comparison Without Minimum Check is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-839?
Modify Application Data, Execute Unauthorized Code or Commands: An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands. DoS: Resource Consumption (Other): in some contexts, a negative value could lead to resource consumption. Modify Memory, Read Memory: If a negative value is used to access memory, buffers, or other indexable structures, it could access memory outside the bounds of the buffer.
Does TurboPentest test for Numeric Range Comparison Without Minimum Check?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest