CWE-75 is titled "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)". MITRE's description is brief: the product does not adequately filter user-controlled input for special elements with control implications.
It is a class, which means a general heading rather than a specific bug. You will usually meet its more concrete children, such as command, SQL or script injection. It is still worth knowing because it names the idea they share.
How it happens
Input that was meant to be data contains elements that a later stage reads as control. The word "plane" describes the jump: data in one context becomes instructions in another. If nothing filters those special elements on the way, the downstream stage acts on them.
The record lists no observed example CVEs for this class itself, since real reports are filed under the more specific weaknesses.
What an attacker gains
MITRE lists integrity, confidentiality and availability: modifying application data and executing unauthorized code or commands.
How to find it
The record names no detection methods for the class. Find the specific child that applies, and use the detection methods listed there. In general, trace user-controlled input to every place it reaches an interpreter or parser.
How to fix it
MITRE offers two mitigations.
- Pick technologies without the issue. In requirements, programming languages and supporting technologies might be chosen which are not subject to these issues.
- Filter special element syntax. In implementation, use an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.
Quick check
What does "different plane" mean here?
Data from one context is interpreted as control in another, because special elements were not filtered along the way.
