1681
Example Language: Perl (Bad)
my $Username = GetUntrustedInput();
$Username =~ s/\.\.\///;
my $filename = "/home/user/" . $Username;
ReadAndSendFile($filename);
Since the regular expression does not have the /g global match modifier, it only removes the first
instance of "../" it comes across. So an input value such as:
Example Language: (Attack)
../../../etc/passwd
will have the first "../" stripped, resulting in:
Example Language: (Result)
../../etc/passwd
This value is then concatenated with the /home/user/ directory:
Example Language: (Result)
/home/user/../../etc/passwd
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../
sequences in the pathname. This leads to relative path traversal (CWE-23).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
CWE-792: Incomplete Filtering of One or More Instances of Special Elements
Weakness ID : 792
Structure : Simple
Abstraction : Variant
Description
The product receives data from an upstream component, but does not completely filter one or more
instances of special elements before sending it to a downstream component.
Extended Description
Incomplete filtering of this nature involves either:
• only filtering a single instance of a special element when more exist, or
• not filtering all instances or all elements where multiple special elements exist.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-792: Incomplete Filtering of One or More Instances of Special Elements
CWE-792: Incomplete Filtering of One or More Instances of Special Elements