Weakness (CWE)
CWE-777: Regular Expression without Anchors
The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.
How to prevent it (1 mitigation)
-
Implementation
Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.
Source: MITRE CWE-777
7 results · Feed
-
Critical 9.8
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application th…
-
Medium 5.4
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular …
-
High 8.2
Apache Traffic Server: Regex mappings match with malicious domain names
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
-
Medium 5.3
Webmin information disclosure via regex pattern
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
-
High 7.6
jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at th…
-
Medium 6.4
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
-
Medium 5.3
Showdownjs Denial of Service
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.