CWE-698: Execution After Redirect (EAR) | Glexia
CWE-698 (Execution After Redirect (EAR)) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE ATT&CK context.
Glexia's Take · Automated analysis
CWE-698: Redirect Without Exit
Execution After Redirect (EAR) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Other,Confidentiality,Integrity,Availability: Alter Execution Logic,Execute Unauthorized Code or Commands: This weakness could affect the control flow of the application and allow execution of untrusted code.
Developer Pattern
CWE-698 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-698, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-698: Execution After Redirect (EAR)
The web application sends a redirect to another location, but instead of exiting, it executes additional code.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- This code queries a server and displays its status when a request comes from an authorized IP address. This code redirects unauthorized users, but continues to execute code after calling http_redirect(). This means even unauthorized users may be able to access the contents of the page or perform a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address spoofing attack (CWE-212).
Remediation
- Use safe APIs
- Centralize the control
- Add regression tests
- Review logs and telemetry for attempted abuse
Detection
- Black Box: This issue might not be detected if testing is performed using a web browser, because the browser might obey the redirect and move the user to a different page before the application has produced outputs that indicate something is amiss.
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.