What is Improper Validation of Array Index (CWE-129)?

TL;DR: Improper Validation of Array Index (CWE-129) occurs when an application uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array. To fix this weakness, use input validation frameworks and ensure security checks are duplicated on the server side.

What is Improper Validation of Array Index?

Improper Validation of Array Index (CWE-129) is a type of vulnerability that occurs when an application uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array. As defined by the MITRE Corporation under CWE-129, and classified by the OWASP Foundation under A05:2025 - Injection…

Quick Summary

Improper Validation of Array Index (CWE-129) is a critical vulnerability that can lead to a range of consequences, including DoS: Crash, Exit, or Restart, Modify Memory, Read Memory, and Execute Unauthorized Code or Commands. It is essential to prevent this weakness by using input validation frameworks and ensuring security checks are duplicated on the server side.

Jump to: Quick Summary · Improper Validation of Array Index Overview · How Improper Validation of Array Index Works · Business Impact of Improper Validation of Array Index · Improper Validation of Array Index Attack Scenario · How to Detect Improper Validation of Array Index · How to Fix Improper Validation of Array Index · Framework-Specific Fixes for Improper Validation of Array Index · How to Ask AI to Check Your Code for Improper Validation of Array Index · Improper Validation of Array Index Best Practices Checklist · Improper Validation of Array Index FAQ · Vulnerabilities Related to Improper Validation of Array Index · References · Scan Your Own Site

Improper Validation of Array Index Overview

What: Improper Validation of Array Index (CWE-129) is a type of vulnerability that occurs when an application uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array.

Why it matters: This vulnerability can lead to a range of consequences, including DoS: Crash, Exit, or Restart, Modify Memory, Read Memory, and Execute Unauthorized Code or Commands. It is essential to prevent this weakness by using input validation frameworks and ensuring security checks are duplicated on the server side.

Where it occurs: Improper Validation of Array Index (CWE-129) can occur in any application that uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array.

Who is affected: Any user who interacts with an application that uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array.

Who is NOT affected: Applications that never construct paths/queries/commands from external input, and systems already using secure coding practices such as input validation frameworks and duplicated security checks on the server side.

How Improper Validation of Array Index Works

Root Cause

Improper Validation of Array Index (CWE-129) occurs when an application uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array.

Attack Flow

1. An attacker provides untrusted input to the application.
2. The application uses the untrusted input to calculate or access an array index.
3. The application does not validate the index to ensure it references a valid position within the array.
4. The attacker exploits the vulnerability by accessing memory outside the bounds of the array.

Prerequisites to Exploit

• Untrusted input must be provided to the application.
• The application must use the untrusted input to calculate or access an array index.
• The application must not validate the index to ensure it references a valid position within the array.

Vulnerable Code

array = [1, 2, 3]
index = int(input("Enter an index: "))
print(array[index])

This code is vulnerable because it uses untrusted input to calculate the array index without validating the index to ensure it references a valid position within the array.

Secure Code

array = [1, 2, 3]
index = int(input("Enter an index: "))
if index < len(array):
    print(array[index])
else:
    print("Invalid index")

This code is secure because it validates the index to ensure it references a valid position within the array before accessing memory.

Business Impact of Improper Validation of Array Index

Confidentiality: Improper Validation of Array Index (CWE-129) can lead to exposure of sensitive data, including financial information and personally identifiable information.

• Integrity: Improper Validation of Array Index (CWE-129) can lead to modification of memory, which can result in unauthorized changes to data.
• Availability: Improper Validation of Array Index (CWE-129) can lead to denial-of-service attacks, including crashes, exits, and restarts.

Real-world business consequences:

• Financial loss due to exposure of sensitive financial information
• Reputation damage due to unauthorized modification of memory
• Downtime and lost productivity due to denial-of-service attacks

Improper Validation of Array Index Attack Scenario

1. An attacker provides untrusted input to the application.
2. The application uses the untrusted input to calculate or access an array index.
3. The application does not validate the index to ensure it references a valid position within the array.
4. The attacker exploits the vulnerability by accessing memory outside the bounds of the array.

How to Detect Improper Validation of Array Index

Manual Testing

• Use a debugger to inspect the code and identify potential vulnerabilities
• Review the code for input validation and error handling
• Test the application with untrusted input to simulate an attack scenario

Automated Scanners (SAST / DAST)

• Static analysis tools can detect potential vulnerabilities in the code, including Improper Validation of Array Index.
• Dynamic analysis tools can simulate an attack scenario and identify potential vulnerabilities.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• Be cautious when interpreting results from automated scanners, as false positives can occur due to similar patterns in the code.
• Review the code manually to confirm the presence of a vulnerability.

How to Fix Improper Validation of Array Index

• Use input validation frameworks such as Struts or the OWASP ESAPI Validation API
• Ensure security checks are duplicated on the server side
• Validate user input before accessing memory

Framework-Specific Fixes for Improper Validation of Array Index

Java

public class ArrayValidator {
    public static void validateArrayIndex(int index, int arrayLength) {
        if (index < 0 || index >= arrayLength) {
            throw new IndexOutOfBoundsException();
        }
    }
}

Python/Django

def validate_array_index(index, array_length):
    if index < 0 or index >= array_length:
        raise IndexError()

PHP

function validateArrayIndex($index, $arrayLength) {
    if ($index < 0 || $index >= $arrayLength) {
        throw new OutOfRangeException();
    }
}

How to Ask AI to Check Your Code for Improper Validation of Array Index

Review the following [language] code block for potential CWE-129 Improper Validation of Array Index vulnerabilities and rewrite it using input validation frameworks:

array = [1, 2, 3]
index = int(input("Enter an index: "))
print(array[index])

Rewrite the code using input validation frameworks such as Struts or the OWASP ESAPI Validation API.

Improper Validation of Array Index Best Practices Checklist

✅ Use input validation frameworks such as Struts or the OWASP ESAPI Validation API ✅ Ensure security checks are duplicated on the server side ✅ Validate user input before accessing memory ✅ Review code manually to confirm the presence of a vulnerability

Improper Validation of Array Index FAQ

How does Improper Validation of Array Index occur?

Improper Validation of Array Index occurs when an application uses untrusted input to calculate or access an array index, without validating the index to ensure it references a valid position within the array.

What are the common consequences of Improper Validation of Array Index?

The common consequences of Improper Validation of Array Index include DoS: Crash, Exit, or Restart, Modify Memory, Read Memory, and Execute Unauthorized Code or Commands.

How can I prevent Improper Validation of Array Index?

You can prevent Improper Validation of Array Index by using input validation frameworks such as Struts or the OWASP ESAPI Validation API, and by ensuring that security checks are duplicated on the server side.

What is the typical severity of Improper Validation of Array Index?

The typical severity of Improper Validation of Array Index varies by instance, but is typically 7.5-8.6 under CVSS v3.1, depending on exploitability and impact.

Can I use a language that does not allow this weakness to occur?

Yes, you can use languages such as Ada, Java, or Ruby that do not allow this weakness to occur, or provide constructs that make it easier to avoid.

How can I detect Improper Validation of Array Index in my code?

You can detect Improper Validation of Array Index in your code by using automated scanners and manual testing, including checking for out-of-range array indices and validating user input.

What are some best practices for preventing Improper Validation of Array Index?

Some best practices for preventing Improper Validation of Array Index include using input validation frameworks, ensuring security checks are duplicated on the server side, and using languages that do not allow this weakness to occur.

Vulnerabilities Related to Improper Validation of Array Index

References

• MITRE Corporation
• OWASP A05:2025 - Injection
• CAPEC-100
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Validation of Array Index and other risks before an attacker does.