CWE-105: Struts: Form Field Without Validator

How it's found

Struts: Form Field Without Validator is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.

Omitting validation for even a single input field may give attackers the leeway they need to compromise the product. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Vulnerable vs. safe

<arg position="0" key="prompt.name"/>

<arg position="0" key="prompt.address"/>

<arg position="0" key="prompt.city"/>

<var-name>mask</var-name><var-value>[a-zA-Z]{2}</var-value><arg position="0" key="prompt.state"/><var></var>

<var-name>mask</var-name><var-value>\d{5}</var-value><arg position="0" key="prompt.zipcode"/><var></var>
<field property="name" depends="required"></field><field property="address" depends="required"></field><field property="city" depends="required"></field><field property="state" depends="required,mask"></field><field property="zipcode" depends="required,mask"></field><form name="RegistrationForm"></form><formset></formset><form-validation></form-validation>

<arg position="0" key="prompt.name"/>

<arg position="0" key="prompt.address"/>

<arg position="0" key="prompt.city"/>

<var-name>mask</var-name><var-value>[a-zA-Z]{2}</var-value><arg position="0" key="prompt.state"/><var></var>

<var-name>mask</var-name><var-value>\d{5}</var-value><arg position="0" key="prompt.zipcode"/><var></var>

<var-name>mask</var-name><var-value>^([0-9]{3})(-)([0-9]{4}|[0-9]{4})$</var-value><arg position="0" key="prompt.phone"/><var></var>

<arg position="0" key="prompt.email"/>
<field property="name" depends="required"></field><field property="address" depends="required"></field><field property="city" depends="required"></field><field property="state" depends="required,mask"></field><field property="zipcode" depends="required,mask"></field><field property="phone" depends="required,mask"></field><field property="email" depends="required,email"></field><form name="RegistrationForm"></form><formset></formset><form-validation></form-validation>

Consequences

• Unexpected State
• Bypass Protection Mechanism: If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.

Mitigations

• Implementation: Validate all form fields. If a field is unused, it is still important to constrain it so that it is empty or undefined.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Base weakness
  CWE-1173: Improper Use of Validation Framework
• Class weakness
  CWE-20: Improper Input Validation