Weakness · High

CWE-134: Use of Externally-Controlled Format String

What it is

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Likelihood of exploit: High3 exploited in the wildMITRE CWE 4.19.1

Severity (our rating): High
Likelihood of exploit: High
Introduced during: Implementation
Exploited in the wild: 3 known exploited CVEs

What an attacker can do

Read Memory (Confidentiality)
Modify Memory (Integrity, Confidentiality, Availability)
Execute Unauthorized Code or Commands (Integrity, Confidentiality, Availability)

How to prevent it

Requirements

Choose a language that is not subject to this flaw.

Implementation

Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings.

Build and Compilation

Run compilers and linkers with high warning levels, since they may detect incorrect usage.

How to find it

Automated Static Analysis. This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.
Black Box. Since format strings often occur in rarely-occurring erroneous conditions (e.g. for error message logging), they can be difficult to detect using black box methods. It is highly likely that many latent issues exist in executables that do not have associated source code (or equivalent source.
Automated Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Highly cost effective: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis Cost effective for partial coverage: Binary / Bytecode simple extractor - strings, ELF readers, etc.
Manual Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Dynamic Analysis with Automated Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners
Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer
Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source
Automated Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Cost effective for partial coverage: Warning Flags
Architecture or Design Review. According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

CWE-134 on MITRE's CWE site

Exploited in the wild: 3 CVEs

Vulnerabilities caused by CWE-134 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.

All known exploited vulnerabilities

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.