CWE-105: Struts: Form Field Without Validator
The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
How it's found
Struts: Form Field Without Validator is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Omitting validation for even a single input field may give attackers the leeway they need to compromise the product. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
Vulnerable vs. safe
<arg position="0" key="prompt.name"/>
<arg position="0" key="prompt.address"/>
<arg position="0" key="prompt.city"/>
<var-name>mask</var-name><var-value>[a-zA-Z]{2}</var-value><arg position="0" key="prompt.state"/><var></var>
<var-name>mask</var-name><var-value>\d{5}</var-value><arg position="0" key="prompt.zipcode"/><var></var>
<field property="name" depends="required"></field><field property="address" depends="required"></field><field property="city" depends="required"></field><field property="state" depends="required,mask"></field><field property="zipcode" depends="required,mask"></field><form name="RegistrationForm"></form><formset></formset><form-validation></form-validation><arg position="0" key="prompt.name"/>
<arg position="0" key="prompt.address"/>
<arg position="0" key="prompt.city"/>
<var-name>mask</var-name><var-value>[a-zA-Z]{2}</var-value><arg position="0" key="prompt.state"/><var></var>
<var-name>mask</var-name><var-value>\d{5}</var-value><arg position="0" key="prompt.zipcode"/><var></var>
<var-name>mask</var-name><var-value>^([0-9]{3})(-)([0-9]{4}|[0-9]{4})$</var-value><arg position="0" key="prompt.phone"/><var></var>
<arg position="0" key="prompt.email"/>
<field property="name" depends="required"></field><field property="address" depends="required"></field><field property="city" depends="required"></field><field property="state" depends="required,mask"></field><field property="zipcode" depends="required,mask"></field><field property="phone" depends="required,mask"></field><field property="email" depends="required,email"></field><form name="RegistrationForm"></form><formset></formset><form-validation></form-validation>Consequences
- Unexpected State
- Bypass Protection Mechanism: If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.
Mitigations
- Implementation: Validate all form fields. If a field is unused, it is still important to constrain it so that it is empty or undefined.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-105?
The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
How do you find Struts: Form Field Without Validator?
Struts: Form Field Without Validator is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-105?
Unexpected State Bypass Protection Mechanism: If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.
Does TurboPentest test for Struts: Form Field Without Validator?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest