CWE-155 is the failure to neutralize wildcards or matching symbols before input reaches a component that interprets them. Stars, question marks and SQL percent signs all mean match many things. If a user can send them, the user can match more than you intended.
File search, glob expansion, LIKE queries and path filters are the usual places. Developers writing search boxes and file handlers meet this often.
How it happens
A search feature takes a term and puts it into a pattern.
import glob
# Vulnerable: the user controls the pattern
files = glob.glob("/data/reports/" + term + ".pdf")
A term of * returns every report. The same idea goes wrong in a LIKE clause, where a percent sign matches anything.
Observed examples from the record show several outcomes. CVE-2002-0433 lists files on a web server using a pattern like star dot extension. CVE-2002-1010 bypasses file restrictions using a wildcard character. CVE-2001-0334 shows wildcards generating a long string on expansion, which points to resource use. CVE-2004-1962 is SQL injection involving comment style sequences.
What an attacker gains
MITRE lists integrity impact as unexpected state. The examples add exposed file listings, restriction bypass and excess resource use.
How to find it
The MITRE page says automated static analysis, which it calls SAST, can find some instances by tracing data from sources to sinks. Add these checks.
- Find calls that build patterns from input: glob, LIKE, regex construction and path filters.
- Send star, question mark and percent characters in every search and filter field.
- Check response size and time for broad matches.
How to fix it
- Escape wildcards for the specific matcher before using input in a pattern.
import glob
# Fixed: literal match only
safe = glob.escape(term)
files = glob.glob("/data/reports/" + safe + ".pdf")
- Use an allowlist for what a search term may contain and reject the rest.
- In SQL, parameterize the query and escape the LIKE metacharacters in the value as well.
- Cap result counts and expansion size.
Quick check
Does a parameterized query stop wildcard matching in LIKE?
No. Parameterization stops injection but a percent sign inside the value is still a wildcard. Escape those characters too.
