What it is: Acceptance of Extraneous Untrusted Data With Trusted Data (CWE-349) is a security vulnerability where untrusted data is accepted alongside trusted data without proper verification.
Why it matters: This can lead to bypassing protection mechanisms and unauthorized access or modification of sensitive data.
How to fix it: Ensure that any untrusted data is properly validated before being combined with trusted data.
TL;DR: Acceptance of Extraneous Untrusted Data With Trusted Data (CWE-349) is a security vulnerability where an application processes untrusted data alongside trusted data without proper verification, leading to potential unauthorized access or modification of sensitive data.
| Field | Value |
|---|---|
| CWE ID | CWE-349 |
| OWASP Category | Not directly mapped |
| CAPEC | 141, 142, 75 |
| Typical Severity | High |
| Affected Technologies | any application that processes both trusted and untrusted data together |
| Detection Difficulty | Moderate |
| Last Updated | 2026-07-29 |
What is Acceptance of Extraneous Untrusted Data With Trusted Data?
Acceptance of Extraneous Untrusted Data With Trusted Data (CWE-349) is a type of security vulnerability that occurs when an application processes trusted data alongside untrusted data without proper verification, treating the untrusted data as if it were trusted. As defined by the MITRE Corporation under CWE-349.
Quick Summary
Acceptance of Extraneous Untrusted Data With Trusted Data allows attackers to package malicious data with legitimate data to bypass security mechanisms and gain unauthorized access or modify sensitive information. This vulnerability can lead to significant business impacts such as financial loss, compliance issues, and reputational damage. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Vulnerabilities
Jump to: Quick Summary · Acceptance of Extraneous Untrusted Data With Trusted Data Overview · How Acceptance of Extraneous Untrusted Data With Trusted Data Works · Business Impact of Acceptance of Extraneous Untrusted Data With Trusted Data · Acceptance of Extraneous Untrusted Data With Trusted Data Attack Scenario · How to Detect Acceptance of Extraneous Untrusted Data With Trusted Data · How to Fix Acceptance of Extraneous Untrusted Data With Trusted Data · Framework-Specific Fixes for Acceptance of Extraneous Untrusted Data With Trusted Data · How to Ask AI to Check Your Code for Acceptance of Extraneous Untrusted Data With Trusted Data · Acceptance of Extraneous Untrusted Data With Trusted Data Best Practices Checklist · Acceptance of Extraneous Untrusted Data With Trusted Data FAQ · Vulnerabilities Related to Acceptance of Extraneous Untrusted Data With Trusted Data · References · Scan Your Own Site
Acceptance of Extraneous Untrusted Data With Trusted Data Overview
What: A security vulnerability where untrusted data is accepted alongside trusted data without proper verification.
Why it matters: This can lead to bypassing protection mechanisms and unauthorized access or modification of sensitive data.
Where it occurs: In applications that process both trusted and untrusted data together, often in contexts like user input validation.
Who is affected: Any application that processes both trusted and untrusted data together.
Who is NOT affected: Applications that properly separate and validate untrusted data before combining it with trusted data.
How Acceptance of Extraneous Untrusted Data With Trusted Data Works
Root Cause
The root cause lies in the failure to verify untrusted data before processing it alongside trusted data, leading to potential security breaches.
Attack Flow
- An attacker packages malicious untrusted data with legitimate trusted data.
- The application processes this combined data without proper validation.
- The untrusted data is treated as if it were trusted, allowing the attack to succeed.
Prerequisites to Exploit
- The application must process both trusted and untrusted data together.
- Proper verification mechanisms for untrusted data are missing or insufficient.
Vulnerable Code
def process_data(trusted_data, user_input):
combined_data = trusted_data + user_input
# Process the combined data without validation
This code is vulnerable because it combines untrusted user_input with trusted data without proper verification.
Secure Code
def process_data(trusted_data, user_input):
if verify_user_input(user_input): # Properly validate user input
combined_data = trusted_data + user_input
# Process the validated data
This code is secure because it verifies user_input before combining it with trusted data.
Business Impact of Acceptance of Extraneous Untrusted Data With Trusted Data
Confidentiality: Sensitive information may be exposed or accessed by unauthorized users. Integrity: Unauthorized modification of sensitive data can occur, leading to data corruption. Availability: In some cases, the availability of services might be compromised if critical operations are affected.
Acceptance of Extraneous Untrusted Data With Trusted Data Attack Scenario
- An attacker packages malicious untrusted data with legitimate trusted data.
- The application processes this combined data without proper validation.
- The untrusted data is treated as if it were trusted, allowing the attack to succeed and potentially compromising sensitive information.
How to Detect Acceptance of Extraneous Untrusted Data With Trusted Data
Manual Testing
- Review code where trusted and untrusted data are processed together.
- Ensure that there are proper validation mechanisms in place for untrusted data before combining it with trusted data.
Automated Scanners (SAST / DAST)
Static analysis can detect instances where untrusted data is combined with trusted data without validation. Dynamic testing can confirm the presence of such vulnerabilities during runtime.
PenScan Detection
PenScan’s automated scanners, including ZAP and Wapiti, can identify cases where untrusted data is improperly combined with trusted data.
False Positive Guidance
A finding is a real vulnerability if the code combines untrusted data directly with trusted data without proper validation. A false positive would occur if there are sufficient checks in place to validate the untrusted data before combining it with trusted data.
How to Fix Acceptance of Extraneous Untrusted Data With Trusted Data
- Ensure that any untrusted data is properly validated before being combined with trusted data.
- Implement robust verification mechanisms for untrusted data.
Framework-Specific Fixes for Acceptance of Extraneous Untrusted Data With Trusted Data
def process_data(trusted_data, user_input):
if verify_user_input(user_input): # Properly validate user input
combined_data = trusted_data + user_input
# Process the validated data
This Python example shows how to properly validate untrusted user_input before combining it with trusted data.
How to Ask AI to Check Your Code for Acceptance of Extraneous Untrusted Data With Trusted Data
Review the following Python code block for potential CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilities and rewrite it using proper validation techniques: [paste code here]
Acceptance of Extraneous Untrusted Data With Trusted Data Best Practices Checklist
✅ Ensure that any untrusted data is properly validated before being combined with trusted data. ✅ Implement robust verification mechanisms for untrusted data.
Acceptance of Extraneous Untrusted Data With Trusted Data FAQ
How does Acceptance of Extraneous Untrusted Data With Trusted Data work?
It occurs when an application processes trusted data alongside untrusted data without proper verification, treating the untrusted data as if it were trusted.
What are the consequences of Acceptance of Extraneous Untrusted Data With Trusted Data?
This vulnerability can lead to bypassing protection mechanisms and unauthorized access or modification of sensitive data.
How do you detect Acceptance of Extraneous Untrusted Data With Trusted Data in code?
Look for instances where untrusted data is processed alongside trusted data without proper validation checks.
What are the best practices to prevent Acceptance of Extraneous Untrusted Data With Trusted Data?
Ensure that any untrusted data is verified and isolated before being combined with trusted data.
How does an attacker exploit Acceptance of Extraneous Untrusted Data With Trusted Data?
An attacker can package malicious data with legitimate data to bypass security measures and gain unauthorized access.
What are the manual testing steps for detecting Acceptance of Extraneous Untrusted Data With Trusted Data?
Review code where trusted and untrusted data are processed together, ensuring proper validation is in place.
How can PenScan help detect Acceptance of Extraneous Untrusted Data With Trusted Data?
Use PenScan’s automated scanners to identify instances where untrusted data is improperly combined with trusted data.
Vulnerabilities Related to Acceptance of Extraneous Untrusted Data With Trusted Data
| CWE | Name | Relationship |
|---|---|---|
| 345 | Insufficient Verification of Data Authenticity | ChildOf |
References
Scan Your Own Site
Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Acceptance of Extraneous Untrusted Data With Trusted Data and other risks before an attacker does.