CWE-107 Variant Draft

Struts: Unused Validation Form

This vulnerability occurs when a Struts application contains validation form definitions that are no longer linked to any active form or action, leaving outdated security rules in the codebase.

Definition

What is CWE-107?

This vulnerability occurs when a Struts application contains validation form definitions that are no longer linked to any active form or action, leaving outdated security rules in the codebase.

In Struts frameworks, validation logic is often tied to specific form or action mappings. When developers rename or remove these mappings during refactoring, they can easily overlook the corresponding validation forms. These orphaned validation rules remain in the configuration files, creating a false sense of security and cluttering the code with dead logic. This situation is problematic because it indicates that the application's validation layer is not being properly maintained. Attackers may exploit the gap between the actual form processing and the intended validation rules, potentially bypassing client-side or server-side checks. Regularly auditing and removing unused validation forms is essential to keep security configurations accurate and effective.

Auswirkungen in der Praxis

Real-world CVEs caused by CWE-107

Bisher sind in MITREs Katalog keine öffentlichen CVE-Referenzen mit dieser CWE verknüpft.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

1
In the following example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data in the form fields using the private member variables. The RegistrationForm class uses the Struts validation capability by extending the ValidatorForm class and including the validation for the form fields within the validator XML file, validator.xml.
2
However, the validator XML file, validator.xml, for the RegistrationForm class includes the validation form for the user input form field "phone" that is no longer used by the input form and the RegistrationForm class. Any validation forms that are no longer required should be removed from the validator XML file, validator.xml.
3
The existence of unused forms may be an indication to attackers that this code is out of date or poorly maintained.

Verwundbares Codebeispiel

Vulnerable Java

In the following example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data in the form fields using the private member variables. The RegistrationForm class uses the Struts validation capability by extending the ValidatorForm class and including the validation for the form fields within the validator XML file, validator.xml.

Verwundbar Java

public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
```
// private variables for registration form* 
  		private String name;
  		private String address;
  		private String city;
  		private String state;
  		private String zipcode;
  		
  		 *// no longer using the phone form field* 
  		
  		
  		 *// private String phone;* 
  		private String email;
  		
  		public RegistrationForm() {
  		```
  			super();
  		}
```
// getter and setter methods for private variables* 
  		...}

Sicheres Codebeispiel

Secure pseudo

Sicher pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Präventions-Checkliste

How to prevent CWE-107

Implementation Remove the unused Validation Form from the validation.xml file.

Erkennungssignale

How to detect CWE-107

SAST High

Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.

DAST Moderate

Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.

Runtime Moderate

Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.

Code review Moderate

Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.

CWE-107

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-107?

This vulnerability occurs when a Struts application contains validation form definitions that are no longer linked to any active form or action, leaving outdated security rules in the codebase.

Wie gravierend ist CWE-107?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-107 betroffen?

MITRE lists the following affected platforms: Java.

Wie kann ich CWE-107 verhindern?

Remove the unused Validation Form from the validation.xml file.

Wie erkennt und behebt Plexicus CWE-107?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-107 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-107?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/107.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-107

CWE-1164 Parent

Bereit zu validieren, was zählt.

Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.

Pentest buchen

Struts: Unused Validation Form

What is CWE-107?

Real-world CVEs caused by CWE-107

Angreiferpfad Schritt für Schritt

Vulnerable Java

Secure pseudo

How to prevent CWE-107

How to detect CWE-107

Don't catalog this weakness. Prove it's reachable.

Frequently asked questions

Weaknesses related to CWE-107

Irrelevant Code

Empty Code Block

Struts: Validator Without Form Field

Dead Code

Assignment to Variable without Use

Further reading

Bereit zu validieren, was zählt.

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Anfrage erhalten. Nächsten Schritt buchen.

Sample evidence handover

Server-Side Request Forgery in `webhooks/receiver`