193
can be erroneous. When the encodings are inconsistent, the downstream component might
treat some character or byte sequences as special, even if they are not special in the original
encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks;
they even might be able to bypass protection mechanisms that assume the original encoding is
also being used by the downstream component. The problem of inconsistent output encodings
often arises in web pages. If an encoding is not specified in an HTTP header, web browsers
often guess about which encoding is being used. This can open up the browser to subtle XSS
attacks.
Phase: Implementation
With Struts, write all data from form beans with the bean's filter attribute set to true.
Phase: Implementation
Strategy = Attack Surface Reduction
To help mitigate XSS attacks against the user's session cookie, set the session cookie to be
HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet
Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible
to malicious client-side scripts that use document.cookie. This is not a complete solution, since
HttpOnly is not supported by all browsers. More importantly, XMLHTTPRequest and other
powerful browser technologies provide read access to HTTP headers, including the Set-Cookie
header in which the HttpOnly flag is set.
Effectiveness = Defense in Depth
Demonstrative Examples
Example 1:
In the following example, an XSS neutralization method intends to replace script tags in usersupplied
input with a safe equivalent:
Example Language: Java (Bad)
public String preventXSS(String input, String mask) {
return input.replaceAll("script", mask);
}
The code only works when the "script" tag is in all lower-case, forming an incomplete denylist
(CWE-184). Equivalent tags such as "SCRIPT" or "ScRiPt" will not be neutralized by this method,
allowing an XSS attack.
Observed Examples
Reference Description
CVE-2002-0738 XSS using "&={script}".
https://www.cve.org/CVERecord?id=CVE-2002-0738
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Alternate XSS syntax
CWE Version 4.14
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-88: Improper Neutralization of Argument
Delimiters in a Command ('Argument Injection') 194
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
199 XSS Using Alternate Syntax
CWE-88: Improper Neutralization of Argument Delimiters in a Command
('Argument Injection')
Weakness ID : 88
Structure : Simple
Abstraction : Base
Description
The product constructs a string for a command to be executed by a separate component in another
control sphere, but it does not properly delimit the intended arguments, options, or switches within
that command string.
Extended Description
When creating commands using interpolation into a string, developers may assume that only the
arguments/options that they specify will be processed. This assumption may be even stronger
when the programmer has encoded the command in a way that prevents separate commands
from being provided maliciously, e.g. in the case of shell metacharacters. When constructing the
command, the developer may use whitespace or other delimiters that are required to separate
arguments when the command. However, if an attacker can provide an untrusted input that
contains argument-separating delimiters, then the resulting command will have more arguments
than intended by the developer. The attacker may then be able to change the behavior of the
command. Depending on the functionality supported by the extraneous arguments, this may have
security-relevant consequences.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 77 Improper Neutralization of Special Elements used in a
Command ('Command Injection')