CWE-151 is the failure to neutralize special elements that a downstream component reads as comment delimiters. Comment markers tell a parser to ignore what follows or what sits between them. If attacker data can contain those markers, the attacker decides what the parser skips.
Mail clients, markup processors, query engines and configuration parsers all have comment syntax. Anything that assembles text for one of them from outside input is in scope.
How it happens
A program accepts a value and drops it into a larger structure. The value contains a comment opener, a closer, or an unbalanced half of one. The next parser reads it as structure.
The observed examples lean toward mail. CVE-2002-0001 is a mail client command execution caused by an improperly terminated comment in an address list. CVE-2004-0162 notes that RFC822 comment fields may be processed as other fields by clients. CVE-2004-1686 is a well placed comment that bypasses a security warning. CVE-2005-1909 is an information hiding case using injected comment code, which MITRE notes is likely vulnerable to more general cross-site scripting problems as well.
What an attacker gains
The record lists integrity impact as unexpected state. The examples make that concrete: hidden content, warnings that never show, and commands run by a client that misread an address list.
How to find it
MITRE lists no detection methods here. Test by hand.
- Send comment openers, closers and unbalanced pairs through every field that ends up in mail headers, markup or generated config.
- Compare how two components parse the same value. Disagreement is the bug.
- Review any filter that removes comments with a pattern. Unterminated comments are the usual miss.
How to fix it
- Expect comments to be injected, removed or manipulated, and design for it.
- Use an allowlist of acceptable input, and reject anything that does not conform to the specification of the field.
- Encode or escape values for the exact destination syntax at the output boundary.
- Parse structured formats with a real parser instead of pattern matching on text.
Quick check
Why are unterminated comments risky?
A parser may keep treating later content as part of the comment, or fall back to a different mode. CVE-2002-0001 came from an improperly terminated comment.
