CWE-240 Base Borrador

Improper Handling of Inconsistent Structural Elements

This vulnerability occurs when a system fails to properly manage situations where related data structures or elements should match but are inconsistent.

Definición

What is CWE-240?

This vulnerability occurs when a system fails to properly manage situations where related data structures or elements should match but are inconsistent.

This weakness stems from a lack of validation or reconciliation logic when processing interconnected data points. For example, an application might check a user's role in one part of a request but ignore a conflicting permission flag sent in another, or it might parse a file header but not verify that the declared data length matches the actual payload size. Without proper handling, these inconsistencies can be exploited to bypass security checks, corrupt data, or cause unexpected system behavior. To prevent this, developers should implement strict consistency checks wherever structural relationships exist. This includes validating that all linked elements (like headers and bodies, metadata and content, or multi-part transaction states) are synchronized and logically coherent before processing. Defensive coding practices, such as using immutable data structures after validation or adopting a single source of truth for critical attributes, can effectively eliminate the risks posed by inconsistent elements.

Impacto en el mundo real

Real-world CVEs caused by CWE-240

CVE-2014-0160

Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data.
CVE-2009-2299

Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.

Cómo lo explotan los atacantes

Ruta del atacante paso a paso

1
Identifica una ruta de código que maneje entrada no confiable sin validación.
2
Crea un payload que ejercite el comportamiento inseguro — inyección, traversal, overflow o abuso de lógica.
3
Envía el payload a través de una solicitud normal y observa la reacción de la aplicación.
4
Itera hasta que la respuesta filtre datos, ejecute código del atacante o escale privilegios.

Ejemplo de código vulnerable

Vulnerable C

In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.

Vulnerable C

int processMessageFromSocket(int socket) {
  		int success;
  		char buffer[BUFFER_SIZE];
  		char message[MESSAGE_SIZE];
```
// get message from socket and store into buffer* 
  		
  		
  		 *//Ignoring possibliity that buffer > BUFFER_SIZE* 
  		if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
  		```
```
// place contents of the buffer into message structure* 
  				ExMessage *msg = recastBuffer(buffer);
  				
  				
  				 *// copy message body into string for processing* 
  				int index;
  				for (index = 0; index < msg->msgLength; index++) {
  				```
  					message[index] = msg->msgBody[index];
  				}
  				message[index] = '\0';
```
// process message* 
  				success = processMessage(message);}
  		return success;}

Ejemplo de código seguro

Secure pseudo

Seguro pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Lista de prevención

How to prevent CWE-240

Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
Implementation Validate input at trust boundaries; use allowlists, not denylists.
Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
Operation Monitor logs for the runtime signals listed in the next section.

Señales de detección

How to detect CWE-240

SAST High

Ejecuta análisis estático (SAST) sobre el código buscando el patrón inseguro en el flujo de datos.

DAST Moderate

Ejecuta pruebas dinámicas de seguridad de aplicaciones (DAST) contra el endpoint en vivo.

Runtime Moderate

Vigila los logs en tiempo de ejecución para detectar trazas de excepción inusuales, entradas malformadas o intentos de bypass de autorización.

Code review Moderate

Revisión de código: marca cualquier código nuevo que maneje entrada desde esta superficie sin usar los helpers validados del framework.

CWE-240

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Preguntas frecuentes

Frequently asked questions

¿Qué es CWE-240?

This vulnerability occurs when a system fails to properly manage situations where related data structures or elements should match but are inconsistent.

¿Qué gravedad tiene CWE-240?

MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.

¿Qué lenguajes o plataformas se ven afectados por CWE-240?

MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.

¿Cómo puedo prevenir CWE-240?

Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.

¿Cómo detecta y corrige Plexicus CWE-240?

El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-240 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.

¿Dónde puedo aprender más sobre CWE-240?

MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/240.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.

Debilidades relacionadas

Weaknesses related to CWE-240

CWE-237 Padre

Listo para validar lo que importa.

Plexicus es Proof-Driven AppSec: hallazgos validados, comprensión contextual y remediación revisada — anclada en evidencia, acotada contigo.

Reservar Pentest

Improper Handling of Inconsistent Structural Elements

What is CWE-240?

Real-world CVEs caused by CWE-240

Ruta del atacante paso a paso

Vulnerable C

Secure pseudo

How to prevent CWE-240

How to detect CWE-240

Don't catalog this weakness. Prove it's reachable.

Frequently asked questions

Weaknesses related to CWE-240

Improper Handling of Structural Elements

Improper Handling of Incomplete Structural Elements

Failure to Handle Incomplete Element

Improper Handling of Length Parameter Inconsistency

Further reading

Listo para validar lo que importa.

Comprueba si el AI Swarm Pentest encaja en tu entorno.

Solicitud recibida. Reserva el siguiente paso.

Sample evidence handover

Server-Side Request Forgery in `webhooks/receiver`