Permissive Regular Expression

Opis

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include:

- not identifying the beginning and end of the target string

- using wildcards instead of acceptable character ranges

- others

Skutki

• Access Control

  Bypass Protection Mechanism

Zapobieganie

• Implementation

  When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.

Przykłady podatności

• CVE-2021-22204 Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.
• CVE-2006-1895 ".*" regexp leads to static code injection
• CVE-2002-2175 insertion of username into regexp results in partial comparison, causing wrong database entry to be updated when one username is a substring of another.
• CVE-2006-4527 regexp intended to verify that all characters are legal, only checks that at least one is legal, enabling file inclusion.
• CVE-2005-1949 Regexp for IP address isn't anchored at the end, allowing appending of shell metacharacters.
• CVE-2002-2109 Regexp isn't "anchored" to the beginning or end, which allows spoofed values that have trusted values as substrings.
• CVE-2006-6511 regexp in .htaccess file allows access of files whose names contain certain substrings
• CVE-2006-6629 allow load of macro files whose names contain certain substrings.

Słabość nadrzędna

• CWE-185 Incorrect Regular Expression

Pokrewna

• CWE-187 Partial String Comparison
• CWE-184 Incomplete List of Disallowed Inputs
• CWE-183 Permissive List of Allowed Inputs

Słabości podrzędne

• CWE-777 Regular Expression without Anchors

Kiedy powstaje

• Implementation — This problem is frequently found when the regular expression is used in input validation or security features such as authentication.

Dotyczy

Perl, PHP

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 8, "Character Stripping Vulnerabilities", Page 437, Addison Wesley, 2006