The product specifies a regular expression in a way that causes data to be improperly matched or compared.
When the regular expression is used in protection mechanisms such as filtering or validation, this may allow an attacker to bypass the intended restrictions on the incoming data.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2002-2109
Regexp isn't "anchored" to the beginning or end, which allows spoofed values that have trusted values as substrings.
CVE: CVE-2005-1949
Regexp for IP address isn't anchored at the end, allowing appending of shell metacharacters.
CVE: CVE-2001-1072
Bypass access restrictions via multiple leading slash, which causes a regular expression to fail.
CVE: CVE-2000-0115
Local user DoS via invalid regular expressions.
CVE: CVE-2002-1527
chain: Malformed input generates a regular expression error that leads to information exposure.
CVE: CVE-2005-1061
Certain strings are later used in a regexp, leading to a resultant crash.
CVE: CVE-2005-2169
MFV. Regular expression intended to protect against directory traversal reduces ".../...//" to "../".
CVE: CVE-2005-0603
Malformed regexp syntax leads to information exposure in error message.
CVE: CVE-2005-1820
Code injection due to improper quoting of regular expression.
CVE: CVE-2005-3153
Null byte bypasses PHP regexp check.
CVE: CVE-2005-4155
Null byte bypasses PHP regexp check.
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: The following code takes phone numbers as input, and uses a regular expression to reject invalid phone numbers.
Body: An attacker could provide an argument such as: "; ls -l ; echo 123-456" This would pass the check, since "123-456" is sufficient to match the "\d+-\d+" portion of the regular expression.
$phone = GetPhoneNumber(); if ($phone =~ /\d+-\d+/) { # looks like it only has hyphens and digits system("lookup-phone $phone"); } else { error("malformed number!"); }Intro: This code uses a regular expression to validate an IP string prior to using it in a call to the "ping" command.
Body: Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^ or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a matched regex pattern. Since the ping command supports octal and hex prepended IP addresses, it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that the attacker cannot reach directly.
import subprocess import re def validate_ip_regex(ip: str): ip_validator = re.compile(r"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}") if ip_validator.match(ip): return ip else: raise ValueError("IP address does not match valid pattern.") def run_ping_regex(ip: str): validated = validate_ip_regex(ip) # The ping command treats zero-prepended IP addresses as octal result = subprocess.call(["ping", validated]) print(result)