CWE-156 is about input where whitespace, such as spaces and tabs, is not neutralized before a downstream component interprets it. Whitespace separates tokens in many formats. Change how much of it there is, or where, and two parsers can read the same bytes differently.
Mail systems, protocol parsers and virus scanners are the classic victims, but any header or line oriented format qualifies.
How it happens
A security check parses a message one way. The final consumer parses it another way. Whitespace is the gap between them.
The observed examples are all from mail processing. CVE-2002-0637 is virus protection bypass with RFC violations involving extra or missing whitespace. CVE-2003-1015 is whitespace interpreted differently by mail clients. CVE-2004-0942 is CPU consumption caused by MIME headers with lines containing many space characters, which MITRE says is probably due to algorithmic complexity.
Two themes show up. One is parser disagreement, where the scanner and the client see different content. The other is cost, where a parser does too much work on long runs of blanks.
What an attacker gains
MITRE lists integrity impact as unexpected state. The examples show protection bypass and denial of service through high CPU use.
How to find it
MITRE lists no detection methods, so test directly.
- Send values with leading, trailing, repeated and mixed whitespace, including tabs and unusual space characters, to every parser in the path.
- Compare the interpretation of the security check and the final consumer.
- Time parsing of inputs with very long whitespace runs.
How to fix it
- Anticipate that whitespace will be injected, removed or manipulated.
- Normalize once, early, and make every later component use the normalized form. Do not let a check and a consumer parse the raw text separately.
- Use an allowlist of acceptable input and reject malformed values instead of repairing them.
- Put limits on line length and on the work a parser does per line.
Quick check
Why can whitespace cause a protection bypass?
If the scanner and the client disagree about where a token ends, the scanner may approve content the client reads differently. CVE-2002-0637 shows this with mail.
Can whitespace cause denial of service?
Yes. CVE-2004-0942 describes CPU consumption from MIME header lines with many spaces.
