COMMON WEAKNESS ENUMERATIONDraft

CWE-75

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

The product does not adequately filter user-controlled input for special elements with control implications.

Abstraction

Class

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product does not adequately filter user-controlled input for special elements with control implications.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Risk

What does successful exploitation lead to?

Modify Application DataExecute Unauthorized Code or Commands

Affected security scopes: Integrity, Confidentiality, Availability

Defence

How is it prevented and fixed?

Requirements

Security requirement

Detail
Programming languages and supporting technologies might be chosen which are not subject to these issues.

Implementation

Implementation-phase defence

Detail
Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.