CWE-76 is a very practical weakness. The product correctly neutralizes certain special elements but fails on equivalent ones that mean the same thing.
Anyone who has written a filter for paths, command arguments or markup has had a chance to make this mistake.
How it happens
The product keeps a fixed list of special characters that it believes is complete. But there may be alternate encodings or representations with the same meaning. MITRE gives two examples.
- A filter removes a leading slash to prevent absolute path names, but does not account for a tilde followed by a user name, which on some *nix systems can expand to an absolute path.
- A filter blocks a dangerous short command-line switch such as "-e" when calling an external program, but does not account for the long form or other switches with the same effect.
In both cases the developer thought about the threat, blocked it, and left a twin open.
A small Python example of the first case:
# Vulnerable: blocks "/" but not "~user"
def clean(p):
return p.lstrip("/")
The result can still start with a tilde, which some systems expand to an absolute path.
What an attacker gains
The record lists only the generic consequence "Other". The actual impact depends on what the underlying filter was protecting, such as file access or command behavior.
How to find it
No detection methods are listed. When reviewing a filter, ask: what other spellings, encodings or switches mean the same thing as what I am blocking? Test each filter with those variants.
How to fix it
MITRE suggests two steps.
- At requirements time, choose languages and technologies that are not subject to these issues.
- In implementation, use a mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.
The allowlist half matters most. A list of what is allowed does not need to know every dangerous twin.
Quick check
Why does a fixed list of bad characters fail?
It can only block what its author thought of. Equivalent encodings, forms or switches with the same meaning pass through.
