SFP Secondary Cluster: Tainted Input to Command

A category in the Common Weakness Enumeration published by The MITRE Corporation.


Summary

Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Weaknesses

ASP.NET Misconfiguration: Not Using Input Validation Framework

The ASP.NET application does not use an input validation framework.

Command Shell in Externally Accessible Directory

A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web se...

Dangling Database Cursor ('Cursor Injection')

If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving ...

Doubled Character XSS Manipulations

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

Dynamic Variable Evaluation

In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary vari...

Executable Regular Expression Error

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserti...

Failure to Sanitize Paired Delimiters

The software does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

The software does not adequately filter user-controlled input for special elements with control implications.

Function Call With Incorrectly Specified Argument Value

The software calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.

Improper Control of Resource Identifiers ('Resource Injection')

The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource t...

Improper Handling of Invalid Use of Special Elements

The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect...

Improper Handling of Length Parameter Inconsistency

The software parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the a...

Improper Neutralization

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from...

Improper Neutralization of Alternate XSS Syntax

The software does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, ...

Improper Neutralization of Comment Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment del...

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF...

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing ...

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neu...

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

The software uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly ne...

Improper Neutralization of Delimiters

The software does not neutralize or incorrectly neutralizes delimiters.

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluatio...

Improper Neutralization of Encoded URI Schemes in a Web Page

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Improper Neutralization of Equivalent Special Elements

The software properly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

Improper Neutralization of Escape, Meta, or Control Sequences

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, met...

Improper Neutralization of Expression/Command Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression ...

Improper Neutralization of HTTP Headers for Scripting Syntax

The application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw hea...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other us...

Improper Neutralization of Input Leaders

The application does not properly handle when a leading character or sequence ("leader") is missing or malformed, or if multiple leaders are used when only one should ...

Improper Neutralization of Input Terminators

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input termi...

Improper Neutralization of Internal Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in un...

Improper Neutralization of Invalid Characters in Identifiers in Web Pages

The software does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Improper Neutralization of Leading Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in une...

Improper Neutralization of Line Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimi...

Improper Neutralization of Macro Symbols

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbo...

Improper Neutralization of Multiple Internal Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpre...

Improper Neutralization of Multiple Leading Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpret...

Improper Neutralization of Multiple Trailing Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpre...

Improper Neutralization of Null Byte or NUL Character

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a down...

Improper Neutralization of Parameter/Argument Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter o...

Improper Neutralization of Quoting Syntax

Quotes injected into an application can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process ...

Improper Neutralization of Record Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record deli...

Improper Neutralization of Script in an Error Message Web Page

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scrip...

Improper Neutralization of Script in Attributes in a Web Page

The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or...

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could b...

Improper Neutralization of Section Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section del...

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

The software generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) ...

Improper Neutralization of Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control ele...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or...

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes sp...

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralize...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralize...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutraliz...

Improper Neutralization of Substitution Characters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitutio...

Improper Neutralization of Trailing Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in un...

Improper Neutralization of Value Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delim...

Improper Neutralization of Variable Name Delimiters

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable na...

Improper Neutralization of Whitespace

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace ...

Improper Neutralization of Wildcards or Matching Symbols

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards o...

Improper Restriction of Names for Files and Other Resources

The application constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting...

Improper Restriction of XML External Entity Reference

The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product...

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other actio...

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, the...

Incorrect Regular Expression

The software specifies a regular expression in a way that causes data to be improperly matched or compared.

Missing XML Validation

The software accepts XML from an untrusted source but does not validate the XML against the proper schema.

Null Byte Interaction Error (Poison Null Byte)

The product does not properly handle null bytes or NUL characters when passing data between different representations or components.

Overly Restrictive Regular Expression

A regular expression is overly restrictive, which prevents dangerous values from being detected.

Permissive List of Allowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are as...

Permissive Regular Expression

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Reliance on File Name or Extension of Externally-Supplied File

The software allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attack...

SQL Injection: Hibernate

Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL...

Struts: Duplicate Validation Forms

The application uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.

Struts: Form Bean Does Not Extend Validation Class

If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input valid...

Struts: Form Field Without Validator

The application has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.

Struts: Incomplete validate() Method Definition

The application has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

Struts: Plug-in Framework not in Use

When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient ...

Struts: Unused Validation Form

An unused validation form indicates that validation logic is not up-to-date.

Struts: Unvalidated Action Form

Every Action Form must have a corresponding validation form.

Struts: Validator Turned Off

Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weakn...

Struts: Validator Without Form Field

Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Use of Externally-Controlled Format String

The software uses a function that accepts a format string as an argument, but the format string originates from an external source.

Variable Extraction Error

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables ar...

XML Injection (aka Blind XPath Injection)

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is ...

Concepts

Software Fault Pattern (SFP) Clusters

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).


Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.