Weakness (CWE)
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
How to prevent it (8 mitigations)
-
Architecture and Design
Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
-
Architecture and Design
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
-
Architecture and Design, Implementation
Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
-
Implementation
When your application combines data from multiple sources, perform the validation after the sources have been combined. The individual data elements may pass the validation step but violate the intended restrictions after they have been combined.
-
Implementation
Be especially careful to validate all input when invoking code that crosses language boundaries, such as from an interpreted language to native code. This could create an unexpected interaction between the language boundaries. Ensure that you are not violating any of the expectations of the language with which you are interfacing. For example, even though Java may not be susceptible to buffer overflows, providing a large argument in a call to native code might trigger an overflow.
-
Implementation
Directly convert your input type into the expected data type, such as using a conversion function that translates a string into a number. After converting to the expected data type, ensure that the input's values fall within the expected range of allowable values and that multi-field consistencies are maintained.
Source: MITRE CWE-20
6,599 results · Feed
-
High 7.5
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processin…
-
High 7.5
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Heal…
-
Critical 9.8
Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry…
-
High 8.8
Backstage: Improper input validation in TechDocs MkDocs configuration
Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDoc…
-
Medium 6.5
Security Advisory 0177
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpecte…
-
Medium 4.9
Security Advisory 0167
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was d…
-
Medium 5.3
Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
-
Medium 6.5
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthentica…
-
Critical 9.6
Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially exe…
-
High 7.8
In multiple locations, there is a possible escalation of privilege due to improper input validation. This could lead to…
-
Medium 6.7
In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validatio…
-
High 8.4
In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. This could lead to l…
-
High 8.8
In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead t…
-
High 7.5
In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote inform…
-
Medium 6.5
In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote (p…
-
High 8.8
In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. T…
-
Medium 4.4
In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This c…
-
Medium 6.7
In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. This could le…
-
Medium 6.7
In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalati…
-
Medium 6.7
In multiple locations, there is a possible out-of-bounds write due to improper input validation. This could lead to loc…
-
Medium 6.7
In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. This could lead to loc…
-
High 7.5
In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote de…
-
High 7.8
In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation. Thi…
-
Medium 6.5
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalcul…
-
High 8.8
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key…
-
Low 2.9
Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to cra…
-
High 8.5
Flowise before 3.1.4 Remote Code Execution via cwd Parameter
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args arr…
-
Medium 4.1
OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization
A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The…
-
Medium 6.9
free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose fi…
-
Medium 5.9
Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites
Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTED_DOMAINS, and then reuses that input hos…
-
Medium 6.9
MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override v…
-
Medium 5.1
Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.…
-
High 7.5
An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attack…
-
High 8.1
Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated att…
-
High 7.5
A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10…
-
Medium 6.5
A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, ma…
-
Medium 5.5
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7…
-
Medium 6.5
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An…
-
High 8.8
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS S…
-
Medium 6.5
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A …