CWE-796 is a variant under CWE-795. The product accounts for special elements only when they sit relative to a marker, such as at the beginning or end of a string, or in the second argument, and misses special elements elsewhere.
How it happens
The marker is the author's assumption about where trouble appears. Examples:
- Strip a trailing slash or trailing whitespace, and consider the value clean.
- Check the first token of a command line and ignore the rest.
- Remove a leading character such as a dash from a value so it cannot be read as an option, while ignoring dashes later on.
def clean_arg(value):
return value.lstrip("-") # handles the start only
If the value is later joined with others or split, special elements that were not at the start can regain meaning.
What an attacker gains
MITRE lists integrity and an unexpected state, with no observed CVEs for this variant. Special elements away from the marker remain in the data and are acted on downstream.
How to find it
- Look for trim, strip, startswith and endswith used as security checks.
- Identify which argument or position each check covers, and which it skips.
- Test with dangerous elements in every position and every argument.
How to fix it
- Validate the whole value against an allowlist.
- When calling programs, pass arguments as a list and use the end-of-options marker where the tool supports one, so values cannot be read as flags.
- Do not rely on position. Make the destination treat the data as data, using encoding, binding or structured calls.
- Test each argument, not only the first.
Quick check
What is a marker in this context?
A reference point such as the start or end of a string, or an argument number, that the filter uses to decide where to look.
