137
(CWE-22). Operating with excessive privileges (CWE-250) might allow an attacker to specify
an input filename that is not directly readable by the attacker, but is accessible to the privileged
program. A buffer overflow (CWE-119) might give an attacker control over nearby memory
locations that are related to pathnames, but were not directly modifiable by the attacker.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Path Manipulation
Software Fault Patterns SFP16 Path Traversal
Related Attack Patterns
CAPEC-ID Attack Pattern Name
13 Subverting Environment Variable Values
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
72 URL Encoding
76 Manipulating Web Input to File System Calls
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
80 Using UTF-8 Encoding to Bypass Validation Logic
267 Leverage Alternate Encoding
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
CWE-74: Improper Neutralization of Special Elements in Output Used by a
Downstream Component ('Injection')
Weakness ID : 74
Structure : Simple
Abstraction : Class
Description
The product constructs all or part of a command, data structure, or record using externallyinfluenced
input from an upstream component, but it does not neutralize or incorrectly neutralizes
special elements that could modify how it is parsed or interpreted when it is sent to a downstream
component.
Extended Description
Software or other automated logic has certain assumptions about what constitutes data and control
respectively. It is the lack of verification of these assumptions for user-controlled input that leads
to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in
very different ways and usually attempted in order to alter the control flow of the process. For
this reason, the most effective way to discuss these weaknesses is to note the distinct features
that classify them as injection weaknesses. The most important issue to note is that all injection
problems share one thing in common -- i.e., they allow for the injection of control plane data into
the user-controlled data plane. This means that the execution of the process may be altered
by sending code in through legitimate data channels, using no other mechanism. While buffer
CWE Version 4.14
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
('Injection')
CWE-74: Improper Neutralization of Special Elements in
Output Used by a Downstream Component ('Injection') 138
overflows, and many other flaws, involve the use of some further issue to gain execution, injection
problems need only for the data to be parsed.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 707 Improper Neutralization 1546
ParentOf 75 Failure to Sanitize Special Elements into a Different Plane
(Special Element Injection)