Example - 1

Consider the following program. It intends to perform an "ls -l" on an input filename. The validate_name() subroutine performs validation on the input to make sure that only alphanumeric and "-" characters are allowed, which avoids path traversal (CWE-22) and OS command injection (CWE-78) weaknesses. Only filenames like "abc" or "d-e-f" are intended to be allowed.

print "Error: name is not well-formed!\n";return;
// # build command// 
my($fname) = @_;if (! validate_name($fname)) {}my $cmd = "/bin/ls -l $fname";system($cmd);


return(1);

return(0);
my($name) = @_;if ($name =~ /^[\w\-]+$/) {}else {}my $arg = GetArgument("filename");do_listing($arg);sub do_listing {}sub validate_name {}

However, validate_name() allowsfilenames that begin with a "-". An adversary couldsupply a filename like "-aR", producing the "ls -l -aR"command (CWE-88), thereby getting a full recursivelisting of the entire directory and all of itssub-directories.There are a couple possible mitigations for thisweakness. One would be to refactor the code to avoidusing system() altogether, instead relying on internalfunctions.Another option could be to add a "--" argumentto the ls command, such as "ls -l --", so that anyremaining arguments are treated as filenames, causingany leading "-" to be treated as part of a filenameinstead of another option.Another fix might be to change the regular expression used in validate_name to force the first character of the filename to be a letter or number, such as:

if ($name =~ /^\w[\w\-]+$/) ...

Example - 2

CVE-2016-10033 / [REF-1249] provides a useful real-world example of this weakness within PHPMailer.

The program calls PHP's mail() function to compose and send mail. The fifth argument to mail() is a set of parameters. The program intends to provide a "-fSENDER" parameter, where SENDER is expected to be a well-formed email address. The program has already validated the e-mail address before invoking mail(), but there is a lot of flexibility in what constitutes a well-formed email address, including whitespace. With some additional allowed characters to perform some escaping, the adversary can specify an additional "-o" argument (listing an output file) and a "-X" argument (giving a program to execute). Additional details for this kind of exploit are in [REF-1250].