454
This can be used by an attacker to bypass the validation and launch attacks that expose
weaknesses that would otherwise be prevented, such as injection.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 179 Incorrect Behavior Order: Early Validation 448
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Validate-before-cleanse :
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
Phase: Implementation
Phase: Architecture and Design
Inputs should be decoded and canonicalized to the application's current internal representation
before being filtered.
Demonstrative Examples
Example 1:
This script creates a subdirectory within a user directory and sets the user as the owner.
Example Language: PHP (Bad)
function createDir($userName,$dirName){
$userDir = '/users/'. $userName;
if(strpos($dirName,'..') !== false){
echo 'Directory name contains invalid sequence';
return;
}
//filter out '~' because other scripts identify user directories by this prefix
$dirName = str_replace('~','',$dirName);
$newDir = $userDir . $dirName;
mkdir($newDir, 0700);
chown($newDir,$userName);
}
While the script attempts to screen for '..' sequences, an attacker can submit a directory path
including ".~.", which will then become ".." after the filtering step. This allows a Path Traversal
(CWE-21) attack to occur.
Observed Examples
Reference Description
CVE-2002-0934 Directory traversal vulnerability allows remote attackers to read or modify
arbitrary files via invalid characters between two . (dot) characters, which are
filtered and result in a ".." sequence.
CWE Version 4.14
CWE-182: Collapse of Data into Unsafe Value
CWE-182: Collapse of Data into Unsafe Value