CWE-625: Permissive Regular Expression (Base)

Description: The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Extended Description: This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include: not identifying the beginning and end of the target string using wildcards instead of acceptable character ranges others



Applicable Platforms: ::LANGUAGE NAME:Perl:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:PHP:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:This problem is frequently found when the regular expression is used in input validation or security features such as authentication.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:When applicable, ensure that the regular expression marks beginning and ending string patterns, such as /^string$/ for Perl.::

Observed Examples: ::REFERENCE:CVE-2021-22204:DESCRIPTION:Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.:LINK:https://www.cve.org/CVERecord?id=CVE-2021-22204::REFERENCE:CVE-2006-1895:DESCRIPTION:.* regexp leads to static code injection:LINK:https://www.cve.org/CVERecord?id=CVE-2006-1895::REFERENCE:CVE-2002-2175:DESCRIPTION:insertion of username into regexp results in partial comparison, causing wrong database entry to be updated when one username is a substring of another.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-2175::REFERENCE:CVE-2006-4527:DESCRIPTION:regexp intended to verify that all characters are legal, only checks that at least one is legal, enabling file inclusion.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-4527::REFERENCE:CVE-2005-1949:DESCRIPTION:Regexp for IP address isn't anchored at the end, allowing appending of shell metacharacters.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1949::REFERENCE:CVE-2002-2109:DESCRIPTION:Regexp isn't anchored to the beginning or end, which allows spoofed values that have trusted values as substrings.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-2109::REFERENCE:CVE-2006-6511:DESCRIPTION:regexp in .htaccess file allows access of files whose names contain certain substrings:LINK:https://www.cve.org/CVERecord?id=CVE-2006-6511::REFERENCE:CVE-2006-6629:DESCRIPTION:allow load of macro files whose names contain certain substrings.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-6629::