Only Filtering Special Elements at an Absolute Position

Incomplete Variant

Structure: Simple

Description

The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.

Common Consequences 1

Scope: Integrity

Impact: Unexpected State

Demonstrative Examples 1

ID : DX-4

The following code takes untrusted input and uses a substring function to filter a 3-character "../" element located at the 0-index position of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.

Code Example:Bad
Perl
perl

Since the if function is only looking for a substring of "../" between the 0 and 2 position, it only removes that specific "../" element. So an input value such as:

Code Example:Attack
bash

will have the first "../" filtered, resulting in:

Code Example:Result
bash

This value is then concatenated with the /home/user/ directory:

Code Example:Result
bash

which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../ sequences in the pathname. This leads to relative path traversal (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Modes of Introduction

Implementation

Related Weaknesses

ChildOf:

Only Filtering Special Elements at a Specified Location (CWE-795)