CWE-793 Variant Incomplete

Only Filtering One Instance of a Special Element

This vulnerability occurs when an application processes incoming data but only removes or neutralizes one occurrence of a dangerous element, leaving other identical or similar elements untouched…

Definition

What is CWE-793?

This vulnerability occurs when an application processes incoming data but only removes or neutralizes one occurrence of a dangerous element, leaving other identical or similar elements untouched before passing the data along.

Imagine a scenario where user input contains multiple instances of a malicious script tag or a special command character. If the security filter is designed to catch and remove only the first (or last) instance it finds, all subsequent instances will pass through unchanged. This creates a deceptive security gap where the code appears to be sanitizing input but is actually performing an incomplete, single-operation cleanup. This type of flaw is often location-dependent, meaning the filter's effectiveness depends on whether it targets the initial or final element in a sequence. Developers might mistakenly assume their filter runs in a loop or uses a global replacement pattern, but a one-time replacement leaves the door open for attackers who can simply embed multiple harmful elements to bypass the defense.

Auswirkungen in der Praxis

Real-world CVEs caused by CWE-793

Bisher sind in MITREs Katalog keine öffentlichen CVE-Referenzen mit dieser CWE verknüpft.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

1
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
2
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:
3
will have the first "../" stripped, resulting in:
4
This value is then concatenated with the /home/user/ directory:
5
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../ sequences in the pathname. This leads to relative path traversal (CWE-23).

Verwundbares Codebeispiel

Vulnerable Perl

The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.

Verwundbar Perl

my $Username = GetUntrustedInput();
  $Username =~ s/\.\.\///;
  my $filename = "/home/user/" . $Username;
  ReadAndSendFile($filename);

Angreifer-Payload

Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:

Angreifer-Payload

../../../etc/passwd

Sicheres Codebeispiel

Secure pseudo

Sicher pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Präventions-Checkliste

How to prevent CWE-793

Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
Implementation Validate input at trust boundaries; use allowlists, not denylists.
Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
Operation Monitor logs for the runtime signals listed in the next section.

Erkennungssignale

How to detect CWE-793

SAST High

Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.

DAST Moderate

Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.

Runtime Moderate

Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.

Code review Moderate

Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.

CWE-793

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-793?

Wie gravierend ist CWE-793?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-793 betroffen?

MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.

Wie kann ich CWE-793 verhindern?

Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.

Wie erkennt und behebt Plexicus CWE-793?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-793 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-793?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/793.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-793

CWE-792 Parent

Incomplete Filtering of One or More Instances of Special Elements

This vulnerability occurs when an application receives external data but fails to properly neutralize all instances of potentially…

CWE-794 Sibling

Incomplete Filtering of Multiple Instances of Special Elements

This vulnerability occurs when an application receives data from a source but fails to remove or neutralize every instance of a…

Ressourcen

Bereit zu validieren, was zählt.

Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.

Pentest buchen