CWE-795 仅在一个特定位置过滤特殊元素

Only Filtering Special Elements at a Specified Location

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.

扩展描述

A filter might only account for instances of special elements when they occur:

This may leave special elements in the data that did not match the filter position, but still may be dangerous.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 791 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 791 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
Integrity Unexpected State

示例代码

例

The following code takes untrusted input and uses a regular expression to filter a "../" element located at the beginning of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.

bad Perl

my $Username = GetUntrustedInput();
$Username =~ s/^..\///;
my $filename = "/home/user/" . $Username;
ReadAndSendFile($filename);

Since the regular expression is only looking for an instance of "../" at the beginning of the string, it only removes the first "../" element. So an input value such as:

attack

../../../etc/passwd

will have the first "../" stripped, resulting in:

result

../../etc/passwd

This value is then concatenated with the /home/user/ directory:

result

/home/user/../../etc/passwd

which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../ sequences in the pathname. This leads to relative path traversal (CWE-22).