23
Scope Impact Likelihood
An attacker could read confidential data if they are able to
control resource references.
Integrity
Confidentiality
Availability
Modify Memory
Execute Unauthorized Code or Commands
An attacker could use malicious input to modify data or
possibly alter control flow in unexpected ways, including
arbitrary command execution.
Detection Methods
Automated Static Analysis
Some instances of improper input validation can be detected using automated static analysis. A
static analysis tool might allow the user to specify which application-specific methods or functions
perform input validation; the tool might also have built-in knowledge of validation frameworks
such as Struts. The tool may then suppress or de-prioritize any associated warnings. This allows
the analyst to focus on areas of the software in which input validation does not appear to be
present. Except in the cases described in the previous paragraph, automated static analysis
might not be able to recognize when proper input validation is being performed, leading to
false positives - i.e., warnings that do not have any security consequences or require any code
changes.
Manual Static Analysis
When custom input validation is required, such as when enforcing business rules, manual
analysis is necessary to ensure that the validation is properly implemented.
Fuzzing
Fuzzing techniques can be useful for detecting input validation errors. When unexpected inputs
are provided to the software, the software should not crash or otherwise become unstable, and
it should generate application-controlled error messages. If exceptions or interpreter-generated
error messages occur, this indicates that the input was not detected and handled within the
application logic itself.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Web
Application Scanner Web Services Scanner Database Scanners
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Fuzz
Tester Framework-based Fuzzer Cost effective for partial coverage: Host Application Interface
Scanner Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper /
virtual machine, see if it does anything suspicious
CWE Version 4.14
CWE-20: Improper Input Validation
CWE-20: Improper Input Validation