CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
AI Translation Available
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Status
incomplete
Abstraction
class
Likelihood
high
Affected Platforms
Technical Details
AI Translation
Common Consequences
confidentiality
access control
other
integrity
non-repudiation
Impacts
read application data
bypass protection mechanism
alter execution logic
other
hide activities
Detection Methods
automated static analysis
Potential Mitigations
Phases:
requirements
implementation
Descriptions:
•
Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
•
Programming languages and supporting technologies might be chosen which are not subject to these issues.