1393
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
When applicable, ensure that the regular expression marks beginning and ending string patterns,
such as "/^string$/" for Perl.
Demonstrative Examples
Example 1:
The following code takes phone numbers as input, and uses a regular expression to reject invalid
phone numbers.
Example Language: Perl (Bad)
$phone = GetPhoneNumber();
if ($phone =~ /\d+-\d+/) {
# looks like it only has hyphens and digits
system("lookup-phone $phone");
}
else {
error("malformed number!");
}
An attacker could provide an argument such as: "; ls -l ; echo 123-456" This would pass the check,
since "123-456" is sufficient to match the "\d+-\d+" portion of the regular expression.
Example 2:
This code uses a regular expression to validate an IP string prior to using it in a call to the "ping"
command.
Example Language: Python (Bad)
import subprocess
import re
def validate_ip_regex(ip: str):
ip_validator = re.compile(r"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}")
if ip_validator.match(ip):
return ip
else:
raise ValueError("IP address does not match valid pattern.")
def run_ping_regex(ip: str):
validated = validate_ip_regex(ip)
# The ping command treats zero-prepended IP addresses as octal
result = subprocess.call(["ping", validated])
print(result)
Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^
or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a
matched regex pattern. Since the ping command supports octal and hex prepended IP addresses,
it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be
considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that
the attacker cannot reach directly.
Observed Examples
CWE Version 4.14
CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-626: Null Byte Interaction Error (Poison Null Byte)