245
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, it can be useful for detecting potential attacks or determining which inputs
are so malformed that they should be rejected outright.
Demonstrative Examples
Example 1:
The following Java code uses input from an HTTP request to create a file name. The programmer
has not considered the possibility that an attacker could provide a file name such as "../../tomcat/
conf/server.xml", which causes the application to delete one of its own configuration files.
Example Language: Java (Bad)
String rName = request.getParameter("reportName");
File rFile = new File("/usr/local/apfr/reports/" + rName);
...
rFile.delete();
Example 2:
The following code uses input from the command line to determine which file to open and echo
back to the user. If the program runs with privileges and malicious users can create soft links to the
file, they can use the program to read the first part of any file on the system.
Example Language: C++ (Bad)
ifstream ifs(argv[0]);
string s;
ifs >> s;
cout << s;
The kind of resource the data affects indicates the kind of content that may be dangerous. For
example, data containing special characters like period, slash, and backslash, are risky when used
in methods that interact with the file system. (Resource injection, when it is related to file system
resources, sometimes goes by the name "path manipulation.") Similarly, data that contains URLs
and URIs is risky for functions that create remote connections.
Observed Examples
Reference Description
CVE-2013-4787 chain: mobile OS verifies cryptographic signature of file in an archive, but then
installs a different file with the same name that is also listed in the archive.
https://www.cve.org/CVERecord?id=CVE-2013-4787
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 813 OWASP Top Ten 2010 Category A4 - Insecure Direct
Object References
809 2357
MemberOf 884 CWE Cross-section 884 2567
MemberOf 932 OWASP Top Ten 2013 Category A4 - Insecure Direct
Object References
928 2390
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1005 7PK - Input Validation and Representation 700 2421
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1340 CISQ Data Protection Measures 1340 2590
CWE Version 4.14
CWE-102: Struts: Duplicate Validation Forms
CWE-102: Struts: Duplicate Validation Forms