449
Nature Type ID Name Page
MemberOf 1215 Data Validation Issues 2478
MemberOf 438 Behavioral Problems 2326
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Integrity
Bypass Protection Mechanism
Execute Unauthorized Code or Commands
An attacker could include dangerous input that bypasses
validation protection mechanisms which can be used to
launch various attacks including injection attacks, execute
arbitrary code or cause other unintended behavior.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Demonstrative Examples
Example 1:
The following code attempts to validate a given input path by checking it against an allowlist and
then return the canonical path. In this specific case, the path is considered valid if it starts with the
string "/safe_dir/".
Example Language: Java (Bad)
String path = getInputPath();
if (path.startsWith("/safe_dir/"))
{
File f = new File(path);
return f.getCanonicalPath();
}
The problem with the above code is that the validation step occurs before canonicalization occurs.
An attacker could provide an input path of "/safe_dir/../" that would pass the validation step.
However, the canonicalization process sees the double dot as a traversal to the parent directory
and hence when canonicized the path would become just "/".
To avoid this problem, validation should occur after canonicalization takes place. In this case
canonicalization occurs during the initialization of the File object. The code below fixes the issue.
Example Language: Java (Good)
String path = getInputPath();
File f = new File(path);
if (f.getCanonicalPath().startsWith("/safe_dir/"))
{
return f.getCanonicalPath();
}
Example 2:
CWE Version 4.14
CWE-179: Incorrect Behavior Order: Early Validation
CWE-179: Incorrect Behavior Order: Early Validation