Weakness (CWE)
CWE-626: Null Byte Interaction Error (Poison Null Byte)
The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
More detail
A null byte (NUL character) can have different meanings across representations or languages. For example, it is a string terminator in standard C libraries, but Perl and PHP strings do not treat it as a terminator. When two representations are crossed - such as when Perl or PHP invokes underlying C functionality - this can produce an interaction error with unexpected results. Similar issues have been reported for ASP. Other interpreters written in C might also be affected.
The poison null byte is frequently useful in path traversal attacks by terminating hard-coded extensions that are added to a filename. It can play a role in regular expression processing in PHP.
How to prevent it (1 mitigation)
-
Implementation
Remove null bytes from all incoming strings.
Source: MITRE CWE-626
9 results · Feed
-
Critical 9.1
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Pe…
-
Low 3.5
Netty: MQTT Topic Name and Client ID Validation Bypass
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null…
-
Medium 6.3
Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection
Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders…
-
High 7.5
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface:…
-
High 7.1
Gnutls: gnutls: authentication bypass via nul character in username
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username…
-
Low 3.7
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes.…
-
Medium 4.4
A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it inco…
-
Critical 9.4CVE-2019-17137 Public exploit
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC12…
-
Unscored —
Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue …