Detalle CWE-158

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

As data is parsed, an injected NUL character or null byte may cause the product to believe the input is terminated earlier than it actually is, or otherwise cause the input to be misinterpreted. This could then be used to inject potentially dangerous input that occurs after the null byte or otherwise bypass validation routines and other protection mechanisms.

Modos de introducción

Implementation

Plataformas aplicables

Lenguaje

Class: Not Language-Specific (Undetermined)
Name: C (Undetermined)
Name: C++ (Undetermined)

Tecnologías

Class: Not Technology-Specific (Undetermined)

Consecuencias comunes

Ejemplos observados

Mitigaciones potenciales

Developers should anticipate that null characters or null bytes will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Phases : Implementation
Phases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Notas de mapeo de vulnerabilidades

Justificación : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comentario : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Patrones de ataque relacionados

Notas

This can be a factor in multiple interpretation errors, other interaction errors, filename equivalence, etc.

Referencias

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-516

ShAnKaR: multiple PHP application poison NULL byte vulnerability
ShAnKaR.
https://seclists.org/fulldisclosure/2006/Sep/185

REF-1494

Null Byte Attacks Explained
Cyber T.
https://medium.com/meetcyber/null-byte-attacks-explained-f032f125b919

REF-1495

What Is Null Byte Injection? How It Works & Examples
Twingate.
https://www.twingate.com/blog/glossary/null%20byte%20injection

Envío

Modificaciones