CWE-163 covers input with several special elements in a row at the end, handled in ways the author did not expect. The observed cases involve piles of trailing slashes or dots on a web request.
Web servers and any code that decides what to show based on how a path ends should care. MITRE lists the weakness as not language specific and not technology specific.
How it happens
A server decides whether to serve an index file, show a listing or refuse based on the end of the path. Extra trailing elements push the path out of the case the rule covers, and the fallback behavior is more generous.
Two observed examples show it. CVE-2002-1078 gives directory listings in a web server using multiple trailing slashes. CVE-2004-0281 gives directory listings with multiple trailing dots.
What an attacker gains
MITRE lists integrity impact as unexpected state. In these cases it meant seeing the names of files in a directory, which helps an attacker find backups, configs and other things to request next.
How to find it
No detection methods are listed. Request each directory with extra trailing slashes and dots, and compare the output with the normal request. A listing where there should be a refusal is the finding.
How to fix it
- Anticipate that multiple trailing special elements will be injected or manipulated.
- Normalize paths so repeated separators and trailing dots collapse before any decision is made.
- Turn directory listing off unless a route needs it, and deny by default.
- Use an allowlist of valid inputs and reject the rest.
Quick check
What is the difference from CWE-162?
CWE-162 is about a single trailing element. This one is about many in a row, which can slip past rules that only handle one.
