CWE-625 Base Borrador

Permissive Regular Expression

This weakness occurs when a regular expression is too permissive, failing to properly validate or sanitize input by allowing unintended values or patterns.

Definición

What is CWE-625?

This weakness occurs when a regular expression is too permissive, failing to properly validate or sanitize input by allowing unintended values or patterns.
A permissive regex often arises from forgetting to anchor the pattern to the start (^) and end ($) of the input string. This causes a partial match, where the system accepts any substring that fits the pattern, rather than validating the entire input. For example, a regex meant to validate a 5-digit ZIP code like \d{5} would incorrectly accept '12345' within 'abc12345def', leading to incomplete validation. Other common mistakes include using overly broad wildcards (like .*) instead of specific character classes, or crafting patterns that fail to exclude dangerous or malformed data. This lax validation can open the door to data corruption, injection attacks, or logic flaws downstream, as the application processes input it assumed was already safe.
Impacto en el mundo real

Real-world CVEs caused by CWE-625

  • CVE-2021-22204

    Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.

  • CVE-2006-1895

    ".*" regexp leads to static code injection

  • CVE-2002-2175

    insertion of username into regexp results in partial comparison, causing wrong database entry to be updated when one username is a substring of another.

  • CVE-2006-4527

    regexp intended to verify that all characters are legal, only checks that at least one is legal, enabling file inclusion.

  • CVE-2005-1949

    Regexp for IP address isn't anchored at the end, allowing appending of shell metacharacters.

  • CVE-2002-2109

    Regexp isn't "anchored" to the beginning or end, which allows spoofed values that have trusted values as substrings.

  • CVE-2006-6511

    regexp in .htaccess file allows access of files whose names contain certain substrings

  • CVE-2006-6629

    allow load of macro files whose names contain certain substrings.

Cómo lo explotan los atacantes

Ruta del atacante paso a paso

  1. 1

    The following code takes phone numbers as input, and uses a regular expression to reject invalid phone numbers.

  2. 2

    An attacker could provide an argument such as: "; ls -l ; echo 123-456" This would pass the check, since "123-456" is sufficient to match the "\d+-\d+" portion of the regular expression.

  3. 3

    This code uses a regular expression to validate an IP string prior to using it in a call to the "ping" command.

  4. 4

    Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^ or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a matched regex pattern. Since the ping command supports octal and hex prepended IP addresses, it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that the attacker cannot reach directly.

Ejemplo de código vulnerable

Vulnerable Perl

The following code takes phone numbers as input, and uses a regular expression to reject invalid phone numbers.

Vulnerable Perl 
$phone = GetPhoneNumber();
  if ($phone =~ /\d+-\d+/) {
```
# looks like it only has hyphens and digits* 
  	system("lookup-phone $phone");} 
  else {
  ```
  	error("malformed number!");
  }
Ejemplo de código seguro

Secure pseudo

Seguro pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención

How to prevent CWE-625

  • Implementation When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.
Señales de detección

How to detect CWE-625

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Auto-corrección de Plexicus

Plexicus detecta automáticamente CWE-625 y abre un PR de corrección en menos de 60 segundos.

Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.

Solicitar demo Probar Plexicus gratis
Preguntas frecuentes

Frequently asked questions

¿Qué es CWE-625?

This weakness occurs when a regular expression is too permissive, failing to properly validate or sanitize input by allowing unintended values or patterns.

¿Qué gravedad tiene CWE-625?

MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.

¿Qué lenguajes o plataformas se ven afectados por CWE-625?

MITRE lists the following affected platforms: Perl, PHP.

¿Cómo puedo prevenir CWE-625?

When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.

¿Cómo detecta y corrige Plexicus CWE-625?

El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-625 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.

¿Dónde puedo aprender más sobre CWE-625?

MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/625.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.

Debilidades relacionadas

Weaknesses related to CWE-625

CWE-185 Padre

Incorrect Regular Expression

This vulnerability occurs when a regular expression is written incorrectly, causing it to match or validate data in unintended and…

CWE-186 Hermano

Overly Restrictive Regular Expression

This weakness occurs when a regular expression is too narrow, failing to detect all the dangerous or unexpected input values it was…

CWE-187 Par

Partial String Comparison

This weakness occurs when software checks only part of a string or token to determine a match, instead of comparing the entire value. This…

CWE-184 Par

Incomplete List of Disallowed Inputs

This vulnerability occurs when a security filter or validation mechanism relies on a 'denylist'—a predefined list of forbidden inputs—but…

CWE-183 Par

Permissive List of Allowed Inputs

This vulnerability occurs when an application's security filter uses an allowlist that is too broad, mistakenly permitting dangerous…

CWE-777 Hijo

Regular Expression without Anchors

This vulnerability occurs when a regular expression used for validation or sanitization lacks anchors, allowing unintended characters or…

Recursos

Further reading

Listo cuando tú lo estés

Deja de pagar por desarrollador.
Empieza a cerrar el bucle.

Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.

Comenzar gratis Reservar una demo