CWE-184: Incomplete List of Disallowed InputsWeakness ID: 184 Vulnerability Mapping:
ALLOWEDThis CWE ID may be used to map to real-world vulnerabilities Abstraction: BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
Description The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. Extended Description Developers often try to protect their products against malicious input by performing tests against inputs that are known to be bad, such as special characters that can invoke new commands. However, such lists often only account for the most well-known bad inputs. Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism. Alternate Terms
Denylist / Deny List: | This is used by CWE and CAPEC instead of other commonly-used terms. Its counterpart is allowlist. |
Blocklist / Block List: | This is often used by security tools such as firewalls, email or web gateways, proxies, etc. |
Blacklist / Black List: | This term is frequently used, but usage has been declining as organizations have started to adopt other terms. |
Common Consequences This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.Scope | Impact | Likelihood |
---|
Access Control
| Technical Impact: Bypass Protection Mechanism | |
Potential Mitigations
Phase: Implementation Strategy: Input Validation Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs. |
Relationships This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Research Concepts" (CWE-1000) Nature | Type | ID | Name |
---|
ChildOf | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1023 | Incomplete Comparison with Missing Factors | ChildOf | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 693 | Protection Mechanism Failure | ParentOf | Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. | 692 | Incomplete Denylist to Cross-Site Scripting | PeerOf | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | PeerOf | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 625 | Permissive Regular Expression | CanPrecede | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CanPrecede | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CanPrecede | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | CanPrecede | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 434 | Unrestricted Upload of File with Dangerous Type |
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Software Development" (CWE-699) Nature | Type | ID | Name |
---|
MemberOf | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1215 | Data Validation Issues |
Modes Of Introduction The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.Phase | Note |
---|
Implementation | Developers might begin to develop a list of bad inputs as a fast way to fix a particular weakness, instead of fixing the root cause. See [REF-141]. | Architecture and Design | The design might rely solely on detection of malicious inputs as a protection mechanism. |
Demonstrative Examples Example 1 The following code attempts to stop XSS attacks by removing all occurences of "script" in an input string. (bad code) Example Language: Java
public String removeScriptTags(String input, String mask) { return input.replaceAll("script", mask); }
Because the code only checks for the lower-case "script" string, it can be easily defeated with upper-case script tags. Observed Examples Reference | Description |
| Chain: API for text generation using Large Language Models (LLMs) does not include the "\" Windows folder separator in its denylist ( CWE-184) when attempting to prevent Local File Inclusion via path traversal ( CWE-22), allowing deletion of arbitrary files on Windows systems. |
| product uses a denylist to identify potentially dangerous content, allowing attacker to bypass a warning |
| PHP remote file inclusion in web application that filters "http" and "https" URLs, but not "ftp". |
| Programming language does not filter certain shell metacharacters in Windows environment. |
| XSS filter doesn't filter null characters before looking for dangerous tags, which are ignored by web browsers. MIE and validate-before-cleanse. |
| Web-based mail product doesn't restrict dangerous extensions such as ASPX on a web server, even though others are prohibited. |
| Resultant XSS when only <script> and <style> are checked. |
| Privileged program does not clear sensitive environment variables that are used by bash. Overlaps multiple interpretation error. |
| SQL injection protection scheme does not quote the "\" special character. |
| Detection of risky filename extensions prevents users from automatically executing .EXE files, but .LNK is accepted, allowing resultant Windows symbolic link. |
| Product uses list of protected variables, but accidentally omits one dangerous variable, allowing external modification |
| Chain: product only removes SCRIPT tags ( CWE-184), enabling XSS ( CWE-79) |
| Chain: product only checks for use of "javascript:" tag ( CWE-184), allowing XSS ( CWE-79) using other tags |
| Chain: OS command injection ( CWE-78) enabled by using an unexpected character that is not explicitly disallowed ( CWE-184) |
| "\" not in list of disallowed values for web server, allowing path traversal attacks when the server is run on Windows and other OSes. |
Weakness Ordinalities Ordinality | Description |
Primary | (where the weakness exists independent of other weaknesses) |
Detection Methods
Black Box Exploitation of a vulnerability with commonly-used manipulations might fail, but minor variations might succeed. |
Memberships This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources. Vulnerability Mapping Notes Usage: ALLOWED (this CWE ID could be used to map to real-world vulnerabilities) | Reason: Acceptable-Use | Rationale: This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities. | Comments: Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. |
Notes Relationship
Multiple interpretation errors can indirectly introduce inputs that should be disallowed. For example, a list of dangerous shell metacharacters might not include a metacharacter that only has meaning in one particular shell, not all of them; or a check for XSS manipulations might ignore an unusual construct that is supported by one web browser, but not others.
Taxonomy Mappings Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
PLOVER | | | Incomplete Blacklist |
References
|
|
[REF-62] Mark Dowd, John McDonald
and Justin Schuh. "The Art of Software Security Assessment". Chapter 8, "Eliminating Metacharacters", Page 435. 1st Edition. Addison Wesley. 2006.
|
Content History Submissions |
---|
Submission Date | Submitter | Organization |
---|
2006-07-19 (CWE Draft 3, 2006-07-19) | PLOVER | | | Modifications |
---|
Modification Date | Modifier | Organization |
---|
2008-07-01 | Sean Eidemiller | Cigital | added/updated demonstrative examples | 2008-07-01 | Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | 2008-09-08 | CWE Content Team | MITRE | updated Detection_Factors, Relationships, Other_Notes, Relationship_Notes, Taxonomy_Mappings, Weakness_Ordinalities | 2008-11-24 | CWE Content Team | MITRE | updated Observed_Examples | 2009-05-27 | CWE Content Team | MITRE | updated Description, Other_Notes, Relationship_Notes, Time_of_Introduction | 2010-02-16 | CWE Content Team | MITRE | updated Relationships | 2010-04-05 | CWE Content Team | MITRE | updated Related_Attack_Patterns | 2010-06-21 | CWE Content Team | MITRE | updated Demonstrative_Examples | 2011-06-01 | CWE Content Team | MITRE | updated Common_Consequences | 2012-05-11 | CWE Content Team | MITRE | updated References, Related_Attack_Patterns, Relationships | 2013-02-21 | CWE Content Team | MITRE | updated Potential_Mitigations | 2014-07-30 | CWE Content Team | MITRE | updated Demonstrative_Examples, Relationships | 2015-12-07 | CWE Content Team | MITRE | updated Relationships | 2017-05-03 | CWE Content Team | MITRE | updated Potential_Mitigations, Related_Attack_Patterns | 2017-11-08 | CWE Content Team | MITRE | updated Applicable_Platforms, References | 2018-03-27 | CWE Content Team | MITRE | updated Observed_Examples, Relationships | 2019-01-03 | CWE Content Team | MITRE | updated Related_Attack_Patterns | 2019-06-20 | CWE Content Team | MITRE | updated Related_Attack_Patterns, Relationships | 2020-02-24 | CWE Content Team | MITRE | updated Alternate_Terms, Description, Detection_Factors, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, Relationship_Notes, Relationships | 2020-06-25 | CWE Content Team | MITRE | updated Alternate_Terms, Observed_Examples | 2021-10-28 | CWE Content Team | MITRE | updated Relationships | 2023-04-27 | CWE Content Team | MITRE | updated References, Relationships | 2023-06-29 | CWE Content Team | MITRE | updated Mapping_Notes, Relationships | 2024-07-16 (CWE 4.15, 2024-07-16) | CWE Content Team | MITRE | updated Observed_Examples | Previous Entry Names |
---|
Change Date | Previous Entry Name |
---|
2020-02-24 | Incomplete Blacklist | |
More information is available — Please edit the custom filter or select a different filter.
|