271
....
c_dom = factory.newDocumentBuilder().parse( xmlFile );
} catch(Exception ex) {
...
}
The XML file is loaded without validating it against a known XML Schema or DTD.
Example 2:
The following code creates a DocumentBuilder object to be used in building an XML document.
Example Language: Java (Bad)
DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
builderFactory.setNamespaceAware(true);
DocumentBuilder builder = builderFactory.newDocumentBuilder();
The DocumentBuilder object does not validate an XML document against a schema, making it
possible to create an invalid XML document.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Missing XML Validation
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
230 Serialized Data with Nested Payloads
231 Oversized Serialized Data Payloads
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
('HTTP Request/Response Splitting')
Weakness ID : 113
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response
Splitting')
CWE-113: Improper Neutralization of CRLF Sequences
in HTTP Headers ('HTTP Request/Response Splitting') 272
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser,
etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is
included in outgoing HTTP headers.
Extended Description
HTTP agents or components may include a web server, load balancer, reverse proxy, web
caching proxy, application firewall, web browser, etc. Regardless of the role, they are expected
to maintain coherent, consistent HTTP communication state across all components. However,
including unexpected data in an HTTP header allows an attacker to specify the entirety of the
HTTP message that is rendered by the client HTTP agent (e.g., web browser) or back-end HTTP
agent (e.g., web server), whether the message is part of a request or a response.
When an HTTP request contains unexpected CR and LF characters, the server may respond with
an output stream that is interpreted as "splitting" the stream into two different HTTP messages
instead of one. CR is carriage return, also given by %0d or \r, and LF is line feed, also given by
%0a or \n.
In addition to CR and LF characters, other valid/RFC compliant special characters and unique
character encodings can be utilized, such as HT (horizontal tab, also given by %09 or \t) and SP
(space, also given as + sign or %20).
These types of unvalidated and unexpected data in HTTP message headers allow an attacker to
control the second "split" message to mount attacks such as server-side request forgery, cross-site
scripting, and cache poisoning attacks.
HTTP response splitting weaknesses may be present when:
1. Data enters a web application through an untrusted source, most frequently an HTTP request.
2. The data is included in an HTTP response header sent to a web user without neutralizing
malicious characters that can be interpreted as separator characters for headers.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 436 Interpretation Conflict 1057
ChildOf 93 Improper Neutralization of CRLF Sequences ('CRLF
Injection')