Weakness · High
CWE-76: Improper Neutralization of Equivalent Special Elements
What it is
The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
- Severity (our rating)
- High
- Likelihood of exploit
- High
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous "-e" command-line switch when calling an external program, but it might not account for "--exec" or other switches that have the same semantics.
What an attacker can do
- Other (Other)
How to prevent it
Requirements
- Programming languages and supporting technologies might be chosen which are not subject to these issues.
Implementation
- Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.