CWE-777
Regular Expression without Anchors
2009-07-27
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Regular Expression without Anchors
The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.
Thông tin chung
Chi tiết nền tảng
Các cách xuất hiện
ImplementationNền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Tên: Python (Undetermined)
Công nghệ
Lớp: Not Technology-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Availability Confidentiality Access Control | Bypass Protection Mechanism, Varies by Context Ghi chú: An unanchored regular expression in the context of an allowlist will possibly result in a protection mechanism failure. Malicious or malformed data may be included before or after any string matching the regular expression, allowing the data to enter trusted regions of the program. The type of malicious data that is allowed will depend on the context of the application and which anchors are omitted from the regular expression. The specific consequences will depend on what functionality the allowlist was protecting. |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2022-30034 | Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390). |
Các biện pháp giảm thiểu tiềm năng
Phases : ImplementationBe sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 1.5 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Likelihood_of_Exploit | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Background_Details, Common_Consequences, Description |
