Tag Archives: CWE- 104

CWE-104 – Struts: Form Bean Does Not Extend Validation Class

Read Time:1 Minute, 1 Second

Description

If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.

In order to use the Struts Validator, a form must extend one of the following: ValidatorForm, ValidatorActionForm, DynaValidatorActionForm, and DynaValidatorForm. One of these classes must be extended because the Struts Validator ties in to the application by implementing the validate() method in these classes. Forms derived from the ActionForm and DynaActionForm classes cannot use the Struts Validator.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-573
CWE-20

 

Consequences

Other: Other

Bypassing the validation framework for a form exposes the application to numerous types of attacks. Unchecked input is an important component of vulnerabilities like cross-site scripting, process control, and SQL injection.

Confidentiality, Integrity, Availability, Other: Other

Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

 

Potential Mitigations

Phase: Implementation

Description: 

Ensure that all forms extend one of the Validation Classes.

CVE References