CWE-1174 is the ASP.NET specific form of a broader problem. The application does not use, or incorrectly uses, the model validation framework. It is a child of the general validation framework weakness, tied to one platform.
If you build ASP.NET controllers that bind request data to models, this one is yours.
How it happens
ASP.NET lets you annotate a model with rules and then records the outcome of checking those rules in ModelState. The weakness appears when an action never consults that outcome, or when the rules are never declared in the first place.
// Vulnerable pattern: validity is never checked
[HttpPost]
public IActionResult Create(UserForm form)
{
_service.Save(form);
return Ok();
}
// Fixed: reject invalid models before using them
[HttpPost]
public IActionResult Create(UserForm form)
{
if (!ModelState.IsValid)
return BadRequest(ModelState);
_service.Save(form);
return Ok();
}
public class UserForm
{
[Required, StringLength(64)] public string Name { get; set; }
[EmailAddress] public string Email { get; set; }
}
Controllers marked with the ApiController attribute return a 400 response automatically when the model is invalid, so check how your controllers are declared before assuming either behavior.
What an attacker gains
MITRE records an integrity impact: unchecked input can lead to cross-site scripting, process control and SQL injection vulnerabilities, among others. The validation gap does not do the damage by itself. It removes a layer that would have stopped the bad value before it reached a vulnerable sink.
How to find it
The record has no detection methods of its own. A practical review is to list every action that takes a bound model and confirm it either checks ModelState.IsValid or sits in a controller that validates automatically. Then confirm each model property that matters carries a rule.
How to fix it
Use the framework on every action that accepts input, declare rules on the model, and return an error response for invalid state. Add a test that posts an invalid payload and expects a rejection.
Quick check
What does ModelState.IsValid tell you?
It reports whether the bound model passed the validation rules declared on it. Ignoring it means invalid data is processed as if it were fine.
