What is Overly Restrictive Regular Expression (CWE-186)?

TL;DR: Overly Restrictive Regular Expression (CWE-186) is a vulnerability where overly restrictive regular expressions prevent dangerous values from being detected, leading to security vulnerabilities. To fix it, refactor complex regular expressions into simpler and more inclusive patterns.

What is Overly Restrictive Regular Expression?

Overly Restrictive Regular Expression (CWE-186) is a vulnerability where regular expressions are overly restrictive, preventing dangerous values from being detected. As defined by the MITRE Corporation under CWE-186.

Quick Summary

Overly restrictive regular expressions can prevent the detection of malicious input values, leading to security vulnerabilities such as unauthorized access and bypassing protection mechanisms. This issue is critical in applications that rely on regular expression validation for user inputs or configuration settings.

Jump to: Quick Summary · Overly Restrictive Regular Expression Overview · How Overly Restrictive Regular Expression Works · Business Impact of Overly Restrictive Regular Expression · Overly Restrictive Regular Expression Attack Scenario · How to Detect Overly Restrictive Regular Expression · How to Fix Overly Restrictive Regular Expression · Framework-Specific Fixes for Overly Restrictive Regular Expression · How to Ask AI to Check Your Code for Overly Restrictive Regular Expression · Overly Restrictive Regular Expression Best Practices Checklist · Overly Restrictive Regular Expression FAQ · Vulnerabilities Related to Overly Restrictive Regular Expression · References · Scan Your Own Site

Overly Restrictive Regular Expression Overview

What: Overly restrictive regular expressions prevent dangerous values from being detected. Why it matters: This can lead to security vulnerabilities by allowing malicious input that bypasses validation checks. Where it occurs: In applications using complex or overly restrictive regular expressions for user inputs or configuration settings. Who is affected: Developers and organizations relying on regular expression validation in their codebases. Who is NOT affected: Applications with well-tested, inclusive regular expressions.

How Overly Restrictive Regular Expression Works

Root Cause

Overly restrictive regular expressions prevent dangerous values from being detected by excluding valid input patterns that could be malicious.

Attack Flow

1. An attacker provides an input value that matches the overly restrictive pattern.
2. The application fails to detect this as a potential threat due to the restrictive nature of the regex.
3. This allows the attacker’s input to bypass validation checks and potentially exploit vulnerabilities in the system.

Prerequisites to Exploit

• Application uses overly restrictive regular expressions for validating user inputs or configuration settings.
• The attacker can provide an input value that matches this restrictive pattern but is still dangerous.

Vulnerable Code

import re

def validate_input(input_value):
    if not re.match(r'^[a-zA-Z0-9_]+$', input_value):
        return False
    return True

Explanation: This regular expression only allows alphanumeric characters and underscores, missing potential malicious patterns that could still be dangerous.

Secure Code

import re

def validate_input(input_value):
    if not re.match(r'^[\w-]+$', input_value):
        return False
    return True

Explanation: The updated regular expression includes a broader set of characters, reducing the likelihood of missing valid but potentially dangerous inputs.

Business Impact of Overly Restrictive Regular Expression

Confidentiality

If overly restrictive regexes are used to validate sensitive data, they may allow unauthorized access to confidential information.

Integrity

Malicious input values bypassing validation can lead to integrity issues by modifying or corrupting application data.

Availability

Exploitation of overly restrictive regular expressions can disrupt system availability through denial-of-service attacks.

Overly Restrictive Regular Expression Attack Scenario

1. An attacker identifies a vulnerable regex pattern in the application’s codebase.
2. The attacker crafts an input value that matches this overly restrictive pattern but is still malicious.
3. This input bypasses validation checks, allowing the attacker to exploit vulnerabilities or gain unauthorized access.

How to Detect Overly Restrictive Regular Expression

Manual Testing

• Review regular expressions for unnecessary exclusions or overly complex conditions.
• Test regular expressions with a variety of valid and invalid inputs to ensure they cover all cases.
• Verify that the regex does not miss any potentially dangerous input patterns.

Automated Scanners (SAST / DAST)

Static analysis tools can detect overly restrictive regular expressions by analyzing code for complex or unnecessary exclusions. Dynamic testing is required to validate these findings in runtime scenarios.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, and Nikto can identify overly restrictive regular expressions during automated scans.

False Positive Guidance

A real finding will show a pattern that prevents valid but potentially dangerous input values. A false positive may appear if the regex is correctly designed to exclude all malicious patterns.

How to Fix Overly Restrictive Regular Expression

• Refactor complex regular expressions into simpler and more inclusive patterns.
• Thoroughly test regular expressions with equivalence partitioning, boundary value analysis, and robustness techniques.
• Record any exploits that slip through and refactor the regular expression accordingly.

Framework-Specific Fixes for Overly Restrictive Regular Expression

Python (Django)

import re

def validate_input(input_value):
    if not re.match(r'^[\w-]+$', input_value):
        return False
    return True

How to Ask AI to Check Your Code for Overly Restrictive Regular Expression

Overly Restrictive Regular Expression Best Practices Checklist

✅ Refactor complex regular expressions into simpler, more inclusive patterns. ✅ Thoroughly test regular expressions with equivalence partitioning and boundary value analysis. ✅ Record any exploits that slip through and refactor the regular expression accordingly.

Overly Restrictive Regular Expression FAQ

How can an overly restrictive regular expression impact application security?

An overly restrictive regular expression can prevent the detection of dangerous input values, leading to potential security vulnerabilities in applications.

What are the common consequences of CWE-186?

Overly restrictive regular expressions can lead to bypassing protection mechanisms and unauthorized access control issues.

How do you detect overly restrictive regular expressions during code review?

Detect overly restrictive regular expressions by reviewing regular expression patterns for unnecessary exclusions or overly complex conditions that may miss dangerous input values.

What are the best practices for preventing CWE-186 in Python applications?

Use simpler and more inclusive regular expressions, thoroughly test them with equivalence partitioning and boundary value analysis to ensure they cover all valid inputs.

How can an overly restrictive regular expression be exploited by attackers?

Attackers may exploit overly restrictive regular expressions by providing input that bypasses validation checks, leading to security vulnerabilities.

What are the potential mitigations for CWE-186 in Java applications?

Refactor complex regular expressions into simpler ones and thoroughly test them with various inputs to ensure they do not miss dangerous values.

How can developers prevent overly restrictive regular expression issues during development?

Developers should use well-tested, inclusive regular expressions and validate their effectiveness through comprehensive testing.

Vulnerabilities Related to Overly Restrictive Regular Expression

| CWE | Name | Relationship | |—|—|—| | CWE-185 | Incorrect Regular Expression | ChildOf |

References

• MITRE - CWE-186
• NVD - National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Overly Restrictive Regular Expression and other risks before an attacker does.