CWE

Incorrect Behavior Order: Validate Before Filter

ID: 181		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: DRAFT
Abstraction Type: Base

Description

The software validates data before it has been filtered, which prevents the software from detecting data that becomes invalid after the filtering step.

Extended Description

This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.

Applicable Platforms
Language Class: All

Time Of Introduction

• Implementation

Related Attack Patterns

• CAPEC-267
• CAPEC-3
• CAPEC-43
• CAPEC-78
• CAPEC-79
• CAPEC-80

Common Consequences

Scope	Technical Impact	Notes
Access_Control	Bypass protection mechanism

Detection Methods
None

Potential Mitigations

Phase	Strategy	Description	Effectiveness	Notes
Implementation Architecture and Design		Inputs should be decoded and canonicalized to the application's current internal representation before being filtered.

Relationships

Related CWE	Type	View	Chain
CWE-181 ChildOf CWE-896	Category	CWE-888

Demonstrative Examples   (Details)

1. This script creates a subdirectory within a user directory and sets the user as the owner. (Demonstrative Example Id DX-36)

Observed Examples

1. CVE-2002-0934 : Directory traversal vulnerability allows remote attackers to read or modify arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
2. CVE-2003-0282 : Directory traversal vulnerability allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.

For more examples, refer to CVE relations in the bottom box.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

Taxynomy	Id	Name	Fit
PLOVER		Validate-Before-Filter
OWASP Top Ten 2004	A1	Unvalidated Input	CWE_More_Specific

References:
None