CWE-1289 – Improper Validation of Unsafe Equivalence in Input

Description

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Modes of Introduction:

– Implementation

Related Weaknesses

CWE-20
CWE-41
CWE-178

Consequences

Other: Varies by Context

Potential Mitigations

Phase: Implementation

Effectiveness: High

Description: 

CVE References

• CVE-2005-0269
  • File extension check in forum software only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters.

• CVE-2001-1238
  • Task Manager does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Process tab which could allow local users to install Trojan horses that cannot be stopped.

• CVE-2004-2214
  • HTTP server allows bypass of access restrictions using URIs with mixed case.