What is Improper Control of Resource Identifiers (CWE-99)?

TL;DR: Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) is a type of vulnerability that occurs when an application receives input from an upstream component without proper restriction or validation.

What is Improper Control of Resource Identifiers (‘Resource Injection’)?

Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) is a type of vulnerability that occurs when an application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. As defined by the MITRE Corporation under CWE-99, and classified by the OWASP Foundation under A05:2025 - Injection, this vulnerability can allow attackers to gain access to or modify sensitive data or system resources.

Quick Summary

Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) is a high-severity vulnerability that can lead to confidentiality and integrity breaches. It occurs when an application receives input from an upstream component without proper restriction or validation. To prevent this vulnerability, implement input validation, use an accept known good input strategy, and reject any input that does not strictly conform to specifications.

Jump to: Quick Summary · Improper Control of Resource Identifiers (‘Resource Injection’) Overview · How Improper Control of Resource Identifiers (‘Resource Injection’) Works · Business Impact of Improper Control of Resource Identifiers (‘Resource Injection’) · Improper Control of Resource Identifiers (‘Resource Injection’) Attack Scenario · How to Detect Improper Control of Resource Identifiers (‘Resource Injection’) · How to Fix Improper Control of Resource Identifiers (‘Resource Injection’) · Framework-Specific Fixes for Improper Control of Resource Identifiers (‘Resource Injection’) · How to Ask AI to Check Your Code for Improper Control of Resource Identifiers (‘Resource Injection’) · Improper Control of Resource Identifiers (‘Resource Injection’) Best Practices Checklist · Improper Control of Resource Identifiers (‘Resource Injection’) FAQ · Vulnerabilities Related to Improper Control of Resource Identifiers (‘Resource Injection’) · References · Scan Your Own Site

Improper Control of Resource Identifiers (‘Resource Injection’) Overview

What: Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) is a type of vulnerability that occurs when an application receives input from an upstream component without proper restriction or validation.

Why it matters: Improper Control of Resource Identifiers (‘Resource Injection’) can allow attackers to gain access to or modify sensitive data or system resources, leading to confidentiality and integrity breaches.

Where it occurs: This vulnerability can occur in any application that receives input from an upstream component, including web applications, mobile applications, and desktop applications.

Who is affected: Any user who interacts with the vulnerable application may be affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Improper Control of Resource Identifiers (‘Resource Injection’) Works

Root Cause

The root cause of Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) is the failure to properly restrict or validate input received from an upstream component before using it as an identifier for a resource that may be outside the intended sphere of control.

Attack Flow

1. An attacker sends malicious input to the vulnerable application.
2. The application receives the input without proper restriction or validation.
3. The application uses the input as an identifier for a resource that may be outside the intended sphere of control.
4. The attacker gains access to or modifies sensitive data or system resources.

Prerequisites to Exploit

• The attacker must send malicious input to the vulnerable application.
• The application must receive the input without proper restriction or validation.
• The application must use the input as an identifier for a resource that may be outside the intended sphere of control.

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This code is vulnerable to Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) because it uses user input as an identifier for a resource without proper restriction or validation.

Secure Code

import os

base_dir = '/home/user'
path = request.form['path']

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')

os.chdir(path)

This code is secure because it properly restricts and validates the input before using it as an identifier for a resource.

Business Impact of Improper Control of Resource Identifiers (‘Resource Injection’)

The business impact of Improper Control of Resource Identifiers (‘Resource Injection’) (CWE-99) can be significant. The vulnerability can allow attackers to gain access to or modify sensitive data or system resources, leading to confidentiality and integrity breaches. This can result in financial losses, damage to reputation, and non-compliance with regulatory requirements.

Confidentiality: Sensitive data may be exposed to unauthorized users.

Integrity: System resources may be modified by unauthorized users.

Improper Control of Resource Identifiers (‘Resource Injection’) Attack Scenario

1. An attacker sends malicious input to the vulnerable application.
2. The application receives the input without proper restriction or validation.
3. The application uses the input as an identifier for a resource that may be outside the intended sphere of control.
4. The attacker gains access to or modifies sensitive data or system resources.

How to Detect Improper Control of Resource Identifiers (‘Resource Injection’)

Manual Testing

• Review code for potential vulnerabilities.
• Use tools such as static analysis and dynamic testing to identify potential issues.

Automated Scanners (SAST / DAST)

• Use automated scanners to identify potential issues in the code.
• Note that SAST can only detect issues related to coding practices, while DAST can detect issues related to the actual behavior of the application.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• Be cautious when interpreting results from automated scanners and manual testing.
• Verify results through additional testing and review.

How to Fix Improper Control of Resource Identifiers (‘Resource Injection’)

• Implement input validation, using an accept known good input strategy.
• Reject any input that does not strictly conform to specifications.
• Use a secure coding approach to prevent this vulnerability.

Framework-Specific Fixes for Improper Control of Resource Identifiers (‘Resource Injection’)

Java

import java.io.File;

File path = new File(request.getParameter('path'));
if (!path.getAbsoluteFile().getParentFile().equals(base_dir)) {
    throw new SecurityException("Invalid path");
}

Node.js

const fs = require('fs');

const path = request.getParameter('path');
if (!fs.existsSync(path) || !fs.lstatSync(path).isDirectory()) {
    throw new Error("Invalid path");
}

Python/Django

import os

base_dir = '/home/user'
path = request.GET['path']

if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')

PHP

$path = $_GET['path'];
if (!is_dir($path) || !strpos($path, $base_dir)) {
    throw new Exception("Invalid path");
}

How to Ask AI to Check Your Code for Improper Control of Resource Identifiers (‘Resource Injection’)

Review the following [language] code block for potential CWE-99 Improper Control of Resource Identifiers (‘Resource Injection’) vulnerabilities and rewrite it using input validation:

import os

path = request.form['path']
os.chdir(path)

Improper Control of Resource Identifiers (‘Resource Injection’) Best Practices Checklist

✅ Implement input validation, using an accept known good input strategy. ✅ Reject any input that does not strictly conform to specifications. ✅ Use a secure coding approach to prevent this vulnerability.

Improper Control of Resource Identifiers (‘Resource Injection’) FAQ

How does Improper Control of Resource Identifiers (‘Resource Injection’) occur?

Improper Control of Resource Identifiers (‘Resource Injection’) occurs when an application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

What are the common consequences of Improper Control of Resource Identifiers (‘Resource Injection’)?

The common consequences of Improper Control of Resource Identifiers (‘Resource Injection’) include read application data, modify application data, read files or directories, and modify files or directories. An attacker could gain access to or modify sensitive data or system resources.

How can I detect Improper Control of Resource Identifiers (‘Resource Injection’) in my code?

You can detect Improper Control of Resource Identifiers (‘Resource Injection’) by using manual testing, automated scanners (SAST / DAST), and PenScan detection. Manual testing involves reviewing your code for potential vulnerabilities, while automated scanners use static analysis to identify potential issues.

What are the best practices for preventing Improper Control of Resource Identifiers (‘Resource Injection’)?

The best practices for preventing Improper Control of Resource Identifiers (‘Resource Injection’) include using input validation, assuming all input is malicious, and rejecting any input that does not strictly conform to specifications.

How can I fix Improper Control of Resource Identifiers (‘Resource Injection’) in my code?

You can fix Improper Control of Resource Identifiers (‘Resource Injection’) by implementing input validation, using an accept known good input strategy, and rejecting any input that does not strictly conform to specifications.

What are the related vulnerabilities to Improper Control of Resource Identifiers (‘Resource Injection’)?

The related vulnerabilities to Improper Control of Resource Identifiers (‘Resource Injection’) include CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), CWE-706 (Use of Incorrectly-Resolved Name or Reference), and CWE-73 (External Control of File Name or Path).

What are the CAPEC IDs related to Improper Control of Resource Identifiers (‘Resource Injection’)?

The CAPEC IDs related to Improper Control of Resource Identifiers (‘Resource Injection’) include CAPEC-10, CAPEC-240, and CAPEC-75.

Vulnerabilities Related to Improper Control of Resource Identifiers (‘Resource Injection’)

References

• MITRE: CWE-99
• OWASP: A05:2025 - Injection
• CAPEC: CAPEC-10, CAPEC-240, CAPEC-75
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Control of Resource Identifiers (‘Resource Injection’) and other risks before an attacker does.