|
|
|
|
CWE-74 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Incomplete 74 (Weakness Class) | | Description | Summary The software fails to adequately filter user-controlled input data for syntax that has control-plane implications. Software has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems span a wide range of instantiations. This is usually attempted in order to alter the control flow of the process. | | Likelihood of Exploit | Very High | | Weakness Ordinality | Primary (Weakness exists independent of other weaknesses) | | Causal Nature | Explicit (This is an explicit weakness resulting from behavior of the developer) | | Common Consequences | Confidentiality: Many injection attacks involve the disclosure of important
information -- in terms of both data sensitivity and usefulness in further exploitation Authentication: In some cases injectable code controls authentication; this
may lead to remote vulnerability Access Control: Injection attacks are characterized by the ability to
significantly change the flow of a given process, and in some cases, to the execution of
arbitrary code. Integrity: Data injection attacks lead to loss of data integrity in nearly all
cases as the control-plane data injected is always incidental to data recall or writing. Accountability: Often the actions performed by injected control code are
unlogged. | | Potential Mitigations | Requirements specification: Programming languages and supporting technologies might be chosen which are not subject
to these issues. Implementation: Utilize an appropriate mix of white-list and black-list parsing to filter control-plane syntax from all input. | | Context Notes | Injection problems encompass a wide variety of issues -- all mitigated in very
different ways. For this reason, the most effective way to discuss these weaknesses is to note the
distinct features which classify them as injection weaknesses. The most important issue to note is
that all injection problems share one thing in common -- i.e., they allow for the injection of
control plane data into the user-controlled data plane. This means that the execution of the
process may be altered by sending code in through legitimate data channels, using no other
mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to
gain execution, injection problems need only for the data to be parsed. The most classic
instantiations of this category of weakness are SQL injection and format string vulnerabilities. | | Relationships | | | Source Taxonomies | CLASP - Injection problem ('data' used as something else) | | Applicable Platforms | All | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 10 | Buffer Overflow via Environment Variables | | 40 | Manipulating Writeable Terminal Devices | | 13 | Subverting Environment Variable Values | | 14 | Client-side Injection-induced Buffer Overflow | | 51 | Poison Web Service Registry | | 42 | MIME Conversion | | 24 | Filter Failure through Buffer Overflow | | 52 | Embedding NULL Bytes | | 43 | Exploiting Multiple Input Interpretation Layers | | 34 | HTTP Response Splitting | | 80 | Using UTF-8 Encoding to Bypass Validation Logic | | 71 | Using Unicode Encoding to Bypass Validation Logic | | 53 | Postfix, Null Terminate, and Backslash | | 72 | URL Encoding | | 45 | Buffer Overflow via Symbolic Links | | 91 | XSS in IMG Tags | | 64 | Using Slashes and URL Encoding Combined to Bypass Validation Logic | | 46 | Overflow Variables and Tags | | 28 | Fuzzing | | 83 | XPath Injection | | 47 | Buffer Overflow via Parameter Expansion | | 84 | XQuery Injection | | 66 | SQL Injection | | 76 | Manipulating Input to File System Calls | | 67 | String Format Overflow in syslog() | | 78 | Using Escaped Slashes in Alternate Encoding | | 79 | Using Slashes in Alternate Encoding | | 101 | Server Side Include (SSI) Injection | | 3 | Using Leading 'Ghost' Character Sequences to Bypass Input Filters | | 7 | Blind SQL Injection | | 8 | Buffer Overflow in an API Call | | 9 | Buffer Overflow in Local Command-Line Utilities |
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
