CWE-147 applies when the product receives input from an upstream component but does not neutralize, or incorrectly neutralizes, special elements that could be read as input terminators by a downstream component. It is a variant of CWE-140 and is language-neutral.
How it happens
A terminator tells a parser that the input is finished. MITRE gives two examples: a "." on its own line signifies the end of mail message data in SMTP, and a null character can be used for the end of a string.
If user data containing a terminator is placed inside a message without being quoted, the receiver may stop early and treat the rest as something else, such as a new command.
MITRE's observed examples are mostly mail servers.
- CVE-2000-0319 and CVE-2000-0320: a mail server does not properly identify the terminator string that signifies the end of a message, causing corruption, possibly together with an off-by-one error.
- CVE-2001-0996: a mail server does not quote the end-of-input terminator if it appears in the middle of a message.
- CVE-2002-0001: an improperly terminated comment or phrase allows commands.
# Vulnerable: body is sent raw, a line with only "." ends the message
sock.send(b"DATA\r\n" + body + b"\r\n.\r\n")
# body containing "\r\n.\r\nMAIL FROM:<x>" starts a new SMTP command
What an attacker gains
MITRE lists an integrity impact with an unexpected state. Messages get cut short or corrupted, and trailing content may be interpreted as commands, as the last CVE above shows.
How to find it
- List the protocols and formats you write that have an end marker.
- Test with the terminator inside the data: a lone dot line, a null byte, and a closing comment or quote sequence.
- Confirm what both sides do when it appears.
How to fix it
- Use a mature client library for the protocol. It applies the right stuffing or quoting rules, such as dot-stuffing for SMTP.
- Prefer length-prefixed framing over terminators when you design a format.
- Reject null bytes in strings that will pass to C APIs.
- Validate the whole message before writing it out.
Quick check
What is dot-stuffing?
It is the SMTP rule of adding an extra dot to any data line that starts with a dot, so a lone dot only ever means the real end of the message. Libraries do this for you.
