CWE-164 describes input where special elements sit inside a value, between other characters, and the product does not neutralize them before sending the value on. A downstream component then interprets the internal element in a way that was not intended.
It sits next to the leading and trailing variants. Those cover the edges of a value. This one covers the middle, where a filter that only looks at the start and end will not notice anything.
How it happens
A validator checks the first and last characters, or splits on one delimiter and inspects the pieces, and passes the value. The downstream parser finds an internal delimiter, separator or escape that the validator never examined.
The record lists no observed examples for this weakness, so treat the description as a pattern to test for instead of a history of known bugs. MITRE explains the mechanism simply: as data is parsed, improperly handled internal special elements may cause the process to take unexpected actions that result in an attack.
What an attacker gains
The record lists integrity impact as unexpected state. The outcome depends on the downstream parser and what it does with the element.
How to find it
MITRE lists no detection methods. Test for it.
- Insert each special character your downstream components care about into the middle of valid looking values.
- Check validators that only trim, only check ends, or split on a single character.
- Compare what the validator saw with what the consumer parsed.
How to fix it
- Anticipate that internal special elements will be injected, removed or manipulated.
- Validate the whole value against a strict allowlist. Reject values that do not conform instead of repairing them.
- Check consistency across related fields and against business rules.
- Escape for the destination at the output boundary.
Quick check
Does trimming input solve this?
No. Trimming handles the edges. Internal elements stay in place, so validate the full value.
