CWE-777 Variante Incomplet Medium likelihood

Regular Expression without Anchors

This vulnerability occurs when a regular expression used for validation or sanitization lacks anchors, allowing unintended characters or malicious payloads to bypass security checks.

Définition

What is CWE-777?

This vulnerability occurs when a regular expression used for validation or sanitization lacks anchors, allowing unintended characters or malicious payloads to bypass security checks.
Anchors like ^ (start of string) and $ (end of string) are critical for security-focused regular expressions. Without them, your pattern only needs to match a portion of the input, not the entire string. This means an attacker can prepend or append malicious content to an otherwise valid value, effectively sneaking dangerous data past your filter. The impact depends on the missing anchor and the application's context. For example, omitting the start anchor allows payloads before a valid pattern, while omitting the end anchor permits trailing malicious code. Always anchor regex patterns used for input validation, allowlisting, or sanitization to enforce a complete match from start to finish.
Impact réel

Real-world CVEs caused by CWE-777

  • CVE-2022-30034

    Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).

Comment les attaquants l'exploitent

Parcours de l'attaquant étape par étape

  1. 1

    Consider a web application that supports multiple languages. It selects messages for an appropriate language by using the lang parameter.

  2. 2

    The previous code attempts to match only alphanumeric values so that language values such as "english" and "french" are valid while also protecting against path traversal, CWE-22. However, the regular expression anchors are omitted, so any text containing at least one alphanumeric character will now pass the validation step. For example, the attack string below will match the regular expression.

  3. 3

    If the attacker can inject code sequences into a file, such as the web server's HTTP request log, then the attacker may be able to redirect the lang parameter to the log file and execute arbitrary code.

  4. 4

    This code uses a regular expression to validate an IP string prior to using it in a call to the "ping" command.

  5. 5

    Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^ or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a matched regex pattern. Since the ping command supports octal and hex prepended IP addresses, it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that the attacker cannot reach directly.

Exemple de code vulnérable

Vulnerable PHP

Consider a web application that supports multiple languages. It selects messages for an appropriate language by using the lang parameter.

Vulnérable PHP 
$dir = "/home/cwe/languages";
  $lang = $_GET['lang'];
  if (preg_match("/[A-Za-z0-9]+/", $lang)) {
  	include("$dir/$lang");
  }
  else {
  	echo "You shall not pass!\n";
  }
Charge utile de l'attaquant

The previous code attempts to match only alphanumeric values so that language values such as "english" and "french" are valid while also protecting against path traversal, CWE-22. However, the regular expression anchors are omitted, so any text containing at least one alphanumeric character will now pass the validation step. For example, the attack string below will match the regular expression.

Charge utile de l'attaquant 
../../etc/passwd
Exemple de code sécurisé

Secure pseudo

Sécurisé pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Liste de contrôle de prévention

How to prevent CWE-777

  • Implementation Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.
Signaux de détection

How to detect CWE-777

SAST High

Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.

DAST Moderate

Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.

Runtime Moderate

Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.

Code review Moderate

Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.

Correction automatique Plexicus

Plexicus détecte automatiquement CWE-777 et ouvre une PR de correction en moins de 60 secondes.

Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.

Obtenir une démo Essayer Plexicus gratuitement
Questions fréquentes

Frequently asked questions

Qu'est-ce que CWE-777 ?

This vulnerability occurs when a regular expression used for validation or sanitization lacks anchors, allowing unintended characters or malicious payloads to bypass security checks.

Quelle est la gravité de CWE-777 ?

MITRE évalue la probabilité d'exploitation comme Moyenne — l'exploitation est réaliste mais nécessite généralement des conditions spécifiques.

Quels langages ou plateformes sont affectés par CWE-777 ?

MITRE n'a pas spécifié les plateformes affectées pour ce CWE — il peut s'appliquer à la plupart des stacks applicatives.

Comment puis-je prévenir CWE-777 ?

Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.

Comment Plexicus détecte et corrige CWE-777 ?

Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-777 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.

Où puis-je en savoir plus sur CWE-777 ?

MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/777.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.

Faiblesses associées

Weaknesses related to CWE-777

CWE-625 Parent

Permissive Regular Expression

This weakness occurs when a regular expression is too permissive, failing to properly validate or sanitize input by allowing unintended…

Ressources

Further reading

Prêt quand vous l'êtes

Arrêtez de payer par développeur.
Commencez à fermer la boucle.

Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.

Commencer gratuitement Réserver une démo