1684
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Demonstrative Examples
Example 1:
The following code takes untrusted input and uses a regular expression to filter "../" from the input.
It then appends this result to the /home/user/ directory and attempts to read the file in the final
resulting path.
Example Language: Perl (Bad)
my $Username = GetUntrustedInput();
$Username =~ s/\.\.\///;
my $filename = "/home/user/" . $Username;
ReadAndSendFile($filename);
Since the regular expression does not have the /g global match modifier, it only removes the first
instance of "../" it comes across. So an input value such as:
Example Language: (Attack)
../../../etc/passwd
will have the first "../" stripped, resulting in:
Example Language: (Result)
../../etc/passwd
This value is then concatenated with the /home/user/ directory:
Example Language: (Result)
/home/user/../../etc/passwd
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../
sequences in the pathname. This leads to relative path traversal (CWE-23).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-793: Only Filtering One Instance of a Special Element
CWE-793: Only Filtering One Instance of a Special Element