461
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Detection Methods
Black Box
Exploitation of a vulnerability with commonly-used manipulations might fail, but minor variations
might succeed.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode
a character, especially when different environments are used, so there is a high likelihood of
missing some variants. Only use detection of disallowed inputs as a mechanism for detecting
suspicious activity. Ensure that you are using other protection mechanisms that only identify
"good" input - such as lists of allowed inputs - and ensure that you are properly encoding your
outputs.
Demonstrative Examples
Example 1:
The following code attempts to stop XSS attacks by removing all occurences of "script" in an input
string.
Example Language: Java (Bad)
public String removeScriptTags(String input, String mask) {
return input.replaceAll("script", mask);
}
Because the code only checks for the lower-case "script" string, it can be easily defeated with
upper-case script tags.
Observed Examples
Reference Description
CVE-2008-2309 product uses a denylist to identify potentially dangerous content, allowing
attacker to bypass a warning
https://www.cve.org/CVERecord?id=CVE-2008-2309
CVE-2005-2782 PHP remote file inclusion in web application that filters "http" and "https" URLs,
but not "ftp".
https://www.cve.org/CVERecord?id=CVE-2005-2782
CVE-2004-0542 Programming language does not filter certain shell metacharacters in Windows
environment.
https://www.cve.org/CVERecord?id=CVE-2004-0542
CVE-2004-0595 XSS filter doesn't filter null characters before looking for dangerous tags, which
are ignored by web browsers. MIE and validate-before-cleanse.
https://www.cve.org/CVERecord?id=CVE-2004-0595
CVE-2005-3287 Web-based mail product doesn't restrict dangerous extensions such as ASPX
on a web server, even though others are prohibited.
https://www.cve.org/CVERecord?id=CVE-2005-3287
CVE-2004-2351 Resultant XSS when only <script> and <style> are checked.
https://www.cve.org/CVERecord?id=CVE-2004-2351
CVE-2005-2959 Privileged program does not clear sensitive environment variables that are
used by bash. Overlaps multiple interpretation error.
https://www.cve.org/CVERecord?id=CVE-2005-2959
CWE Version 4.14
CWE-184: Incomplete List of Disallowed Inputs
CWE-184: Incomplete List of Disallowed Inputs