CWEweakness
CWE-181 Incorrect Behavior Order: Validate Before Filter
- Alternate terms
- Validate-before-cleanse
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
Common consequences
• Access Control: Bypass Protection Mechanism — This prevents the product from detecting data
that becomes invalid after the filtering step. An
attacker can bypass the validation and launch attacks
that expose weaknesses that would otherwise be
prevented, such as injection.
Potential mitigations
• [Implementation, Architecture and Design] Inputs should be decoded and canonicalized to the application's current internal representation before being filtered.
Observed examples
• CVE-2002-0934: Directory traversal vulnerability allows remote attackers to read or modify arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
• CVE-2003-0282: Directory traversal vulnerability allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
Related
Attack pattern · CAPEC (7)
- CAPEC-120 Double Encoding attack pattern
- CAPEC-267 Leverage Alternate Encoding attack pattern
- CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters attack pattern
- CAPEC-43 Exploiting Multiple Input Interpretation Layers attack pattern
- CAPEC-78 Using Escaped Slashes in Alternate Encoding attack pattern
- CAPEC-79 Using Slashes in Alternate Encoding attack pattern
- CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic attack pattern
Observed example · CVE (2)
- CVE-2003-0282 Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . vulnerability
- CVE-2002-0934 Directory traversal vulnerability in Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) allows remote attackers to read… vulnerability
Child of · CWE (1)
- CWE-179 Incorrect Behavior Order: Early Validation weakness
Referenced by CAPEC · weakness (7)
- CAPEC-120 Double Encoding attack pattern
- CAPEC-267 Leverage Alternate Encoding attack pattern
- CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters attack pattern
- CAPEC-43 Exploiting Multiple Input Interpretation Layers attack pattern
- CAPEC-78 Using Escaped Slashes in Alternate Encoding attack pattern
- CAPEC-79 Using Slashes in Alternate Encoding attack pattern
- CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic attack pattern