CWE-85 is a web application that does not filter user-controlled input for executable script disguised by doubling the characters involved.
It affects code that tries to clean input by removing or replacing a bad pattern once.
How it happens
A filter strips a dangerous string a single time. The attacker doubles the characters, so that what remains after the strip is still the dangerous string. Or the attacker adds an extra character that the filter ignores but the browser tolerates.
The observed examples show the variety: CVE-2002-2086 is XSS using a doubled script tag opener, CVE-2000-0116 is an encoded "javascript" in an image tag and CVE-2001-1157 is an extra opening angle bracket in front of a script tag. See CVE-2002-2086, CVE-2000-0116 and CVE-2001-1157.
# Vulnerable: one pass only
clean = user_input.replace("javascript:", "")
# "javajavascript:script:" becomes "javascript:"
What an attacker gains
MITRE lists confidentiality, integrity and availability: reading application data and running unauthorized code or commands in the victim's session.
How to find it
The record lists no detection methods. Test filters with doubled and padded variants of every pattern they remove.
How to fix it
- Resolve filtered input to absolute or canonical representations before processing.
- Check each parameter against an allowlist of allowed characters and format, covering all request data, including tag attributes, hidden fields, cookies, headers and the URL.
- Do not strip and trust. If something dangerous is found, reject the input instead of repairing it.
Quick check
Why does removing a pattern once fail?
The leftover characters can join to form the same pattern again after the removal.
