251
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Struts: Erroneous validate() Method
Software Fault Patterns SFP24 Tainted input to command
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-104: Struts: Form Bean Does Not Extend Validation Class
Weakness ID : 104
Structure : Simple
Abstraction : Variant
Description
If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose
the application to other weaknesses related to insufficient input validation.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 573 Improper Following of Specification by Caller 1298
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Background Details
In order to use the Struts Validator, a form must extend one of the following: ValidatorForm,
ValidatorActionForm, DynaValidatorActionForm, and DynaValidatorForm. One of these classes
must be extended because the Struts Validator ties in to the application by implementing the
validate() method in these classes. Forms derived from the ActionForm and DynaActionForm
classes cannot use the Struts Validator.
Common Consequences
Scope Impact Likelihood
Other Other
Bypassing the validation framework for a form exposes the
application to numerous types of attacks. Unchecked input
is an important component of vulnerabilities like cross-site
scripting, process control, and SQL injection.
CWE Version 4.14
CWE-104: Struts: Form Bean Does Not Extend Validation Class
CWE-104: Struts: Form Bean Does Not Extend Validation Class