459
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Observed Examples
Reference Description
CVE-2019-12799 chain: bypass of untrusted deserialization issue (CWE-502) by using an
assumed-trusted class (CWE-183)
https://www.cve.org/CVERecord?id=CVE-2019-12799
CVE-2019-10458 sandbox bypass using a method that is on an allowlist
https://www.cve.org/CVERecord?id=CVE-2019-10458
CVE-2017-1000095sandbox bypass using unsafe methods that are on an allowlist
https://www.cve.org/CVERecord?id=CVE-2017-1000095
CVE-2019-10458 CI/CD pipeline feature has unsafe elements in allowlist, allowing bypass of
script restrictions
https://www.cve.org/CVERecord?id=CVE-2019-10458
CVE-2017-1000095Default allowlist includes unsafe methods, allowing bypass of sandbox
https://www.cve.org/CVERecord?id=CVE-2017-1000095
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Permissive Whitelist
Related Attack Patterns
CAPEC-ID Attack Pattern Name
3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
43 Exploiting Multiple Input Interpretation Layers
71 Using Unicode Encoding to Bypass Validation Logic
120 Double Encoding
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-184: Incomplete List of Disallowed Inputs
Weakness ID : 184
Structure : Simple
CWE Version 4.14
CWE-184: Incomplete List of Disallowed Inputs
CWE-184: Incomplete List of Disallowed Inputs