CWE-181: Incorrect Behavior Order: Validate Before Filter
Incorrect Behavior Order: Validate Before Filter
Weakness ID: 181 (Weakness Base)
Status: Draft
Description
Description Summary
The software validates data before it has been filtered, which prevents the software from detecting data that becomes invalid after the filtering step.
Extended Description
This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.
Alternate Terms
Validate-before-cleanse
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
Demonstrative Examples
Example 1
This script creates a subdirectory within a user directory and sets
the user as the owner.
(Bad Code)
Example
Language: PHP
function createDir($userName,$dirName){
$userDir = '/users/'. $userName;
if(strpos($dirName,'..') !== false){
echo 'Directory name contains invalid sequence';
return;
}
//filter out '~' because other scripts identify user
directories by this prefix
$dirName = str_replace('~','',$dirName);
$newDir = $userDir . $dirName;
mkdir($newDir, 0700);
chown($newDir,$userName);
}
While the script attempts to screen for '..' sequences, an attacker can submit a directory path including ".~.", which will then become ".." after the filtering step. This allows a Path Traversal (CWE-21) attack to occur.
Directory traversal vulnerability allows remote
attackers to read or modify arbitrary files via invalid characters between
two . (dot) characters, which are filtered and result in a ".." sequence.
Directory traversal vulnerability allows
attackers to overwrite arbitrary files via invalid characters between two .
(dot) characters, which are filtered and result in a ".." sequence.
Potential Mitigations
Phases: Implementation; Architecture and Design
Inputs should be decoded and canonicalized to the application's
current internal representation before being filtered.
Description
