What is Improper Neutralization of Value (CWE-142)?

TL;DR: Improper Neutralization of Value Delimiters (CWE-142) occurs when a product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component. To fix CWE-142 vulnerabilities, developers should assume all input is malicious and use an “accept known good” input validation strategy.

What is Improper Neutralization of Value Delimiters?

Improper Neutralization of Value Delimiters (CWE-142) is a type of injection vulnerability that occurs when a product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component. As defined by the MITRE Corporation under CWE-142, and classified by the OWASP Foundation under Not directly mapped…

Quick Summary

Improper Neutralization of Value Delimiters (CWE-142) is a critical vulnerability that can lead to unexpected state changes, compromising confidentiality and integrity. It occurs when a product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Jump to: Quick Summary · Improper Neutralization of Value Delimiters Overview · How Improper Neutralization of Value Delimiters Works · Business Impact of Improper Neutralization of Value Delimiters · Improper Neutralization of Value Delimiters Attack Scenario · How to Detect Improper Neutralization of Value Delimiters · How to Fix Improper Neutralization of Value Delimiters · Framework-Specific Fixes for Improper Neutralization of Value Delimiters · How to Ask AI to Check Your Code for Improper Neutralization of Value Delimiters · Improper Neutralization of Value Delimiters Best Practices Checklist · Improper Neutralization of Value Delimiters FAQ · Vulnerabilities Related to Improper Neutralization of Value Delimiters · References · Scan Your Own Site

Improper Neutralization of Value Delimiters Overview

What

Improper Neutralization of Value Delimiters (CWE-142) is a type of injection vulnerability that occurs when a product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Why it matters

Improper Neutralization of Value Delimiters (CWE-142) can lead to unexpected state changes, which can compromise confidentiality and integrity. It is essential to prevent CWE-142 vulnerabilities by using an appropriate combination of denylists and allowlists to ensure only valid, expected, and appropriate input is processed by the system.

Where it occurs

Improper Neutralization of Value Delimiters (CWE-142) can occur in various web application frameworks, including Java EE/EJB, Spring, ASP.NET, and Django.

Who is affected

Any product that receives input from an upstream component and does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component is vulnerable to CWE-142.

Who is NOT affected

Products that use an appropriate combination of denylists and allowlists to ensure only valid, expected, and appropriate input is processed by the system are not vulnerable to CWE-142.

How Improper Neutralization of Value Delimiters Works

Root Cause

The root cause of CWE-142 is when a product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Attack Flow

1. An attacker injects malicious input into the system.
2. The system processes the input without properly neutralizing special elements.
3. The malicious input is sent to a downstream component, which can lead to unexpected state changes and compromise confidentiality and integrity.

Prerequisites to Exploit

The following prerequisites must be true for CWE-142 to be exploitable:

• The product receives input from an upstream component.
• The product does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Vulnerable Code

input = request.form['input']
path = os.path.join('/path/to/directory', input)

This code is vulnerable because it does not properly neutralize special elements in the input. An attacker can inject malicious input, such as ../, which can lead to unexpected state changes and compromise confidentiality and integrity.

Secure Code

input = request.form['input']
path = os.path.join('/path/to/directory', input)
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")

This code is secure because it properly neutralizes special elements in the input by checking if the absolute path starts with the base directory.

Business Impact of Improper Neutralization of Value Delimiters

Confidentiality

Improper Neutralization of Value Delimiters (CWE-142) can lead to unexpected state changes, which can compromise confidentiality. An attacker can inject malicious input that reveals sensitive information or compromises user authentication.

Integrity

Improper Neutralization of Value Delimiters (CWE-142) can also lead to unexpected state changes, which can compromise integrity. An attacker can inject malicious input that modifies data or compromises system configuration.

Availability

Improper Neutralization of Value Delimiters (CWE-142) can disrupt system availability by causing the system to crash or become unresponsive.

Improper Neutralization of Value Delimiters Attack Scenario

1. An attacker injects malicious input into the system.
2. The system processes the input without properly neutralizing special elements.
3. The malicious input is sent to a downstream component, which can lead to unexpected state changes and compromise confidentiality and integrity.

How to Detect Improper Neutralization of Value Delimiters

Manual Testing

• Review code for proper neutralization of special elements.
• Test system with malicious input to ensure proper handling.

Automated Scanners (SAST / DAST)

Automated scanners can detect CWE-142 vulnerabilities by analyzing code and identifying potential injection points. However, dynamic analysis is required to confirm the presence of CWE-142 vulnerabilities.

PenScan Detection

PenScan’s automated scanners detect CWE-142 vulnerabilities in real-time using a combination of static and dynamic analysis.

False Positive Guidance

To avoid false positives, review system logs and configuration files for any signs of malicious activity. Also, ensure that all input is properly sanitized before processing.

How to Fix Improper Neutralization of Value Delimiters

• Assume all input is malicious.
• Use an “accept known good” input validation strategy.
• Properly quote arguments and escape special characters within those arguments.

Framework-Specific Fixes for Improper Neutralization of Value Delimiters

Java

input = request.getParameter('input');
path = new File('/path/to/directory', input).getAbsolutePath();
if (!path.startsWith(base_dir)) {
    throw new SecurityException("Invalid path");
}

Node.js

const express = require('express');
const app = express();

app.get('/', (req, res) => {
    const input = req.query.input;
    const path = `${base_dir}/${input}`;
    if (!path.startsWith(base_dir)) {
        throw new Error("Invalid path");
    }
});

Python/Django

from django.http import HttpResponse

def view(request):
    input = request.GET.get('input')
    path = os.path.join('/path/to/directory', input)
    if not os.path.abspath(path).startswith(base_dir):
        raise ValueError("Invalid path")
    return HttpResponse("Hello, World!")

PHP

<?php
$input = $_GET['input'];
$path = '/path/to/directory/' . $input;
if (!strpos($path, base_dir)) {
    throw new Exception("Invalid path");
}
?>

How to Ask AI to Check Your Code for Improper Neutralization of Value Delimiters

Review the following [language] code block for potential CWE-142 Improper Neutralization of Value Delimiters vulnerabilities and rewrite it using primary fix technique: [paste code here]

Improper Neutralization of Value Delimiters Best Practices Checklist

✅ Assume all input is malicious. ✅ Use an “accept known good” input validation strategy. ✅ Properly quote arguments and escape special characters within those arguments.

Improper Neutralization of Value Delimiters FAQ

How does Improper Neutralization of Value Delimiters occur?

Improper Neutralization of Value Delimiters occurs when a product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

What is the impact of CWE-142 on business?

CWE-142 can lead to unexpected state changes, which can compromise confidentiality and integrity.

How do I prevent CWE-142 vulnerabilities?

To prevent CWE-142 vulnerabilities, developers should anticipate that value delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected, and appropriate input is processed by the system.

What are some common frameworks affected by CWE-142?

CWE-142 can affect various web application frameworks, including Java EE/EJB, Spring, ASP.NET, and Django.

How do I detect CWE-142 vulnerabilities in my code?

To detect CWE-142 vulnerabilities, use a combination of manual testing and automated scanning tools like PenScan.

What are some best practices for preventing CWE-142 vulnerabilities?

Some best practices include assuming all input is malicious, using an “accept known good” input validation strategy, and properly quoting arguments and escaping special characters within those arguments.

Can AI assistants help me detect CWE-142 vulnerabilities in my code?

Yes, AI assistants like PenScan’s coding assistant can help you review your code for potential CWE-142 vulnerabilities and provide recommendations for remediation.

Vulnerabilities Related to Improper Neutralization of Value Delimiters

References

• https://cwe.mitre.org/data/definitions/142.html
• CAPEC-1: Injection Flaw
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Neutralization of Value Delimiters and other risks before an attacker does.