CWE-184: Incomplete List of Disallowed Inputs

Description

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Abstraction: BaseA weakness specific enough to point to detection and prevention methods.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Access Control
Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.

Potential mitigations

ImplementationInput Validation
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify good input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Related weaknesses

Parent weaknesses

Child weaknesses

CWE-692Incomplete Denylist to Cross-Site Scripting

Can lead to

CAPEC attack patterns that exploit it

BaseDraftCWE-184

CWE-184: Incomplete List of Disallowed Inputs

Description

Abstraction: BaseA weakness specific enough to point to detection and prevention methods.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Access Control
Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.

Potential mitigations

ImplementationInput Validation
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify good input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.