465
def run_ping_regex(ip: str):
validated = validate_ip_regex(ip)
# The ping command treats zero-prepended IP addresses as octal
result = subprocess.call(["ping", validated])
print(result)
Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^
or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a
matched regex pattern. Since the ping command supports octal and hex prepended IP addresses,
it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be
considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that
the attacker cannot reach directly.
Observed Examples
Reference Description
CVE-2002-2109 Regexp isn't "anchored" to the beginning or end, which allows spoofed values
that have trusted values as substrings.
https://www.cve.org/CVERecord?id=CVE-2002-2109
CVE-2005-1949 Regexp for IP address isn't anchored at the end, allowing appending of shell
metacharacters.
https://www.cve.org/CVERecord?id=CVE-2005-1949
CVE-2001-1072 Bypass access restrictions via multiple leading slash, which causes a regular
expression to fail.
https://www.cve.org/CVERecord?id=CVE-2001-1072
CVE-2000-0115 Local user DoS via invalid regular expressions.
https://www.cve.org/CVERecord?id=CVE-2000-0115
CVE-2002-1527 chain: Malformed input generates a regular expression error that leads to
information exposure.
https://www.cve.org/CVERecord?id=CVE-2002-1527
CVE-2005-1061 Certain strings are later used in a regexp, leading to a resultant crash.
https://www.cve.org/CVERecord?id=CVE-2005-1061
CVE-2005-2169 MFV. Regular expression intended to protect against directory traversal
reduces ".../...//" to "../".
https://www.cve.org/CVERecord?id=CVE-2005-2169
CVE-2005-0603 Malformed regexp syntax leads to information exposure in error message.
https://www.cve.org/CVERecord?id=CVE-2005-0603
CVE-2005-1820 Code injection due to improper quoting of regular expression.
https://www.cve.org/CVERecord?id=CVE-2005-1820
CVE-2005-3153 Null byte bypasses PHP regexp check.
https://www.cve.org/CVERecord?id=CVE-2005-3153
CVE-2005-4155 Null byte bypasses PHP regexp check.
https://www.cve.org/CVERecord?id=CVE-2005-4155
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
Notes
Relationship
CWE Version 4.14
CWE-186: Overly Restrictive Regular Expression
CWE-186: Overly Restrictive Regular Expression