CWE-141 applies when the product receives input from an upstream component but does not neutralize, or incorrectly neutralizes, special elements that could be read as parameter or argument delimiters by a downstream component. It is a variant under CWE-140, and it is language-neutral.
How it happens
MITRE sums it up this way: as data is parsed, an injected, absent or malformed delimiter may cause the process to take unexpected actions. Spaces, commas, ampersands and semicolons often separate parameters. When a program builds a line of parameters from user input, a separator inside a value creates a new parameter.
The observed example is CVE-2003-0307, where an attacker inserts a field separator into input to specify admin privileges.
# Vulnerable: a space in name starts a new key=value pair
line = "user=" + name + " role=guest"
# name = "bob role=admin" gives: user=bob role=admin role=guest
If the parser keeps the first value for a repeated key, the attacker has chosen the role.
What an attacker gains
MITRE lists an integrity impact with an unexpected state. The attacker adds or overrides parameters. What that means depends on the consumer: a changed privilege, a different file, or an altered option for a program run with those arguments.
How to find it
- Find every place you build a parameter string, command line or query string by concatenation.
- Submit values containing the separators the consumer uses and inspect the result.
- Check what the parser does with duplicate keys.
How to fix it
- Pass parameters as structured data, such as an argument array, a map, or a URL builder that encodes values, not as one string.
- Encode or reject separator characters in values.
- Set security-relevant parameters after any user supplied ones, in code, so they cannot be overridden.
- Validate values against an allow list.
# Fixed: structured arguments, no shared string
subprocess.run(["tool", "--user", name, "--role", "guest"], check=True)
Quick check
Why is a duplicate parameter a risk?
Parsers differ on whether the first or last value wins. If an attacker can add a parameter, they may be able to override one the program set.
