Ejecuta análisis estático (SAST) sobre el código buscando el patrón inseguro en el flujo de datos.
CWE-187 Variante Incompleto
Partial String Comparison
This weakness occurs when software checks only part of a string or token to determine a match, instead of comparing the entire value. This incomplete validation can lead to incorrect security…
Definición
What is CWE-187?
This weakness occurs when software checks only part of a string or token to determine a match, instead of comparing the entire value. This incomplete validation can lead to incorrect security decisions.
Partial string comparison happens when a system, such as an authentication module, validates only the first few characters of an input against a stored value. For example, if a password check only verifies the initial 5 characters, an attacker could gain access by providing any password that starts with those same 5 characters, regardless of the full correct password.
This flaw fundamentally undermines security logic by treating partially matching inputs as fully authorized. Developers should always enforce complete, exact-string comparisons for security-critical operations like authentication, authorization tokens, or integrity checks to prevent attackers from exploiting these predictable shortcuts.
Impacto en el mundo real
Real-world CVEs caused by CWE-187
-
Product does not prevent access to restricted directories due to partial string comparison with a public directory
-
Argument parser of an IMAP server treats a partial command "body[p" as if it is "body.peek", leading to index error and out-of-bounds corruption.
-
Web browser only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.
-
One-character password by attacker checks only against first character of real password.
-
One-character password by attacker checks only against first character of real password.
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.
- 2
In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass parameter in order to determine how many characters to check in the password. So, if the attacker only provides a password of length 1, the check will only examine the first byte of the application's password before determining success.
- 3
As a result, this partial comparison leads to improper authentication (CWE-287).
- 4
Any of these passwords would still cause authentication to succeed for the "admin" user:
- 5
This significantly reduces the search space for an attacker, making brute force attacks more feasible.
Ejemplo de código vulnerable
Vulnerable C
This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.
```
/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */*
char *username = "admin";
char *pass = "password";
int AuthenticateUser(char *inUser, char *inPass) {
```
if (strncmp(username, inUser, strlen(inUser))) {
logEvent("Auth failure of username using strlen of inUser");
return(AUTH_FAIL);
}
if (! strncmp(pass, inPass, strlen(inPass))) {
logEvent("Auth success of password using strlen of inUser");
return(AUTH_SUCCESS);
}
else {
logEvent("Auth fail of password using sizeof");
return(AUTH_FAIL);
}
}
int main (int argc, char **argv) {
int authResult;
if (argc < 3) {
ExitError("Usage: Provide a username and password");
}
authResult = AuthenticateUser(argv[1], argv[2]);
if (authResult == AUTH_SUCCESS) {
DoAuthenticatedTask(argv[1]);
}
else {
ExitError("Authentication failed");
}
} Payload del atacante
Any of these passwords would still cause authentication to succeed for the "admin" user:
p
pa
pas
pass Ejemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-187
- Testing Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Señales de detección
How to detect CWE-187
Ejecuta pruebas dinámicas de seguridad de aplicaciones (DAST) contra el endpoint en vivo.
Vigila los logs en tiempo de ejecución para detectar trazas de excepción inusuales, entradas malformadas o intentos de bypass de autorización.
Revisión de código: marca cualquier código nuevo que maneje entrada desde esta superficie sin usar los helpers validados del framework.
CWE-187
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Preguntas frecuentes ¿Qué es CWE-187?
¿Qué gravedad tiene CWE-187?
¿Qué lenguajes o plataformas se ven afectados por CWE-187?
¿Cómo puedo prevenir CWE-187?
¿Cómo detecta y corrige Plexicus CWE-187?
¿Dónde puedo aprender más sobre CWE-187?
Frequently asked questions
¿Qué es CWE-187?
This weakness occurs when software checks only part of a string or token to determine a match, instead of comparing the entire value. This incomplete validation can lead to incorrect security decisions.
¿Qué gravedad tiene CWE-187?
MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.
¿Qué lenguajes o plataformas se ven afectados por CWE-187?
MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.
¿Cómo puedo prevenir CWE-187?
Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
¿Cómo detecta y corrige Plexicus CWE-187?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-187 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-187?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/187.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-187
CWE-1023 Padre
Incomplete Comparison with Missing Factors
This weakness occurs when a program compares two items but fails to check all the necessary attributes that define their true…
CWE-184 Hermano
Incomplete List of Disallowed Inputs
This vulnerability occurs when a security filter or validation mechanism relies on a 'denylist'—a predefined list of forbidden inputs—but…
CWE-478 Hermano
Missing Default Case in Multiple Condition Expression
This vulnerability occurs when code with multiple conditional branches, like a switch statement, lacks a default case to handle unexpected…
CWE-839 Hermano
Numeric Range Comparison Without Minimum Check
This vulnerability occurs when software validates that a number is within an acceptable range by only checking that it's less than or…
¿Listo para validar lo que importa?
Listo para validar lo que importa.
Plexicus es Proof-Driven AppSec: hallazgos validados, comprensión contextual y remediación revisada — anclada en evidencia, acotada contigo.