CWE-181: Incorrect Behavior Order: Validate Before Filter
Also known as: Validate-before-cleanse
The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
Last updated
Overview
This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.
Common consequences
What can happen when CWE-181 is exploited.
Bypass Protection Mechanism
Affects: Access Control
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-181, grouped by where in the lifecycle they apply.
Inputs should be decoded and canonicalized to the application's current internal representation before being filtered.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
This script creates a subdirectory within a user directory and sets the user as the owner.
Vulnerable example
function createDir($userName,$dirName){While the script attempts to screen for '..' sequences, an attacker can submit a directory path including ".~.", which will then become ".." after the filtering step. This allows a Path Traversal (CWE-21) attack to occur.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2002-0934 — Directory traversal vulnerability allows remote attackers to read or modify arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
- CVE-2003-0282 — Directory traversal vulnerability allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
Terminology & mappings
Alternate terms
- Validate-before-cleanse
Mapped taxonomies
- PLOVER: Validate-Before-Filter
- OWASP Top Ten 2004: Unvalidated Input (A1) — CWE More Specific fit
Attack patterns
CAPEC attack patterns that exploit this weakness.
- CAPEC-120: Double Encoding
- CAPEC-267: Leverage Alternate Encoding
- CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters
- CAPEC-43: Exploiting Multiple Input Interpretation Layers
- CAPEC-78: Using Escaped Slashes in Alternate Encoding
- CAPEC-79: Using Slashes in Alternate Encoding
- CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic
Frequently asked questions
Common questions about CWE-181.
- What is CWE-181?
- The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
- Is CWE-181 part of the OWASP Top 10?
- CWE-181 maps to OWASP Top Ten 2004: Unvalidated Input (A1) in the OWASP security taxonomy.
- How do you prevent CWE-181?
- Inputs should be decoded and canonicalized to the application's current internal representation before being filtered.
- What are the consequences of CWE-181?
- Exploiting CWE-181 can lead to: Bypass Protection Mechanism.
References
- MITRE CWE definition (CWE-181) (opens in a new tab)
- CWE-181 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-181
Get alerted the moment a new CWE-181 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.