CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- High
- Status
- Incomplete
Common consequences
- Confidentiality
Read Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
- Access Control
Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
- Other
Alter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
- IntegrityOther
Other
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
- Non-Repudiation
Hide Activities
Often the actions performed by injected control code are unlogged.
Potential mitigations
- Requirements
Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation
Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-91XML Injection (aka Blind XPath Injection)
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-94Improper Control of Generation of Code ('Code Injection')
- CWE-99Improper Control of Resource Identifiers ('Resource Injection')
- CWE-943Improper Neutralization of Special Elements in Data Query Logic
- CWE-1236Improper Neutralization of Formula Elements in a CSV File
CAPEC attack patterns that exploit it
- CAPEC-3Using Leading 'Ghost' Character Sequences to Bypass Input Filters
- CAPEC-6Argument Injection
- CAPEC-7Blind SQL Injection
- CAPEC-8Buffer Overflow in an API Call
- CAPEC-9Buffer Overflow in Local Command-Line Utilities
- CAPEC-10Buffer Overflow via Environment Variables
- CAPEC-13Subverting Environment Variable Values
- CAPEC-14Client-side Injection-induced Buffer Overflow
- CAPEC-24Filter Failure through Buffer Overflow
- CAPEC-28Fuzzing
- CAPEC-34HTTP Response Splitting
- CAPEC-42MIME Conversion
- CAPEC-43Exploiting Multiple Input Interpretation Layers
- CAPEC-45Buffer Overflow via Symbolic Links
- CAPEC-46Overflow Variables and Tags
- CAPEC-47Buffer Overflow via Parameter Expansion
- CAPEC-51Poison Web Service Registry
- CAPEC-52Embedding NULL Bytes
- CAPEC-53Postfix, Null Terminate, and Backslash
- CAPEC-64Using Slashes and URL Encoding Combined to Bypass Validation Logic
- CAPEC-67String Format Overflow in syslog()
- CAPEC-71Using Unicode Encoding to Bypass Validation Logic
- CAPEC-72URL Encoding
- CAPEC-76Manipulating Web Input to File System Calls
- CAPEC-78Using Escaped Slashes in Alternate Encoding
- CAPEC-79Using Slashes in Alternate Encoding
- CAPEC-80Using UTF-8 Encoding to Bypass Validation Logic
- CAPEC-83XPath Injection
- CAPEC-84XQuery Injection
- CAPEC-101Server Side Include (SSI) Injection
- CAPEC-105HTTP Request Splitting
- CAPEC-108Command Line Execution through SQL Injection
- CAPEC-120Double Encoding
- CAPEC-135Format String Injection
- CAPEC-250XML Injection
- CAPEC-267Leverage Alternate Encoding
- CAPEC-273HTTP Response Smuggling