What is Incomplete List of Disallowed Inputs (CWE-184)?

TL;DR: Incomplete List of Disallowed Inputs (CWE-184) occurs when a protection mechanism relies on a list of inputs that are not allowed by policy or otherwise require other action to neutralize, but the list is incomplete.

What is Incomplete List of Disallowed Inputs?

Incomplete List of Disallowed Inputs (CWE-184) is a type of vulnerability that occurs when a protection mechanism relies on a list of inputs that are not allowed by policy or otherwise require other action to neutralize, but the list is incomplete. As defined by the MITRE Corporation under CWE-184, and classified by the OWASP Foundation under None…

Quick Summary

Incomplete List of Disallowed Inputs (CWE-184) occurs when a protection mechanism relies on a list of inputs that are not allowed by policy or otherwise require other action to neutralize, but the list is incomplete. This can lead to serious security issues and potential data breaches.

Jump to: Quick Summary · Incomplete List of Disallowed Inputs Overview · How Incomplete List of Disallowed Inputs Works · Business Impact of Incomplete List of Disallowed Inputs · Incomplete List of Disallowed Inputs Attack Scenario · How to Detect Incomplete List of Disallowed Inputs · How to Fix Incomplete List of Disallowed Inputs · Framework-Specific Fixes for Incomplete List of Disallowed Inputs · How to Ask AI to Check Your Code for Incomplete List of Disallowed Inputs · Incomplete List of Disallowed Inputs Best Practices Checklist · Incomplete List of Disallowed Inputs FAQ · Vulnerabilities Related to Incomplete List of Disallowed Inputs · References · Scan Your Own Site

Incomplete List of Disallowed Inputs Overview

What: Incomplete List of Disallowed Inputs (CWE-184) is a type of vulnerability that occurs when a protection mechanism relies on a list of inputs that are not allowed by policy or otherwise require other action to neutralize, but the list is incomplete.

Why it matters: Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism. This can lead to serious security issues and potential data breaches.

Where it occurs: CWE-184 can occur in any system or application that relies on a list of disallowed inputs for protection.

Who is affected: Any user who interacts with the system or application may be affected by CWE-184.

Who is NOT affected: Users who do not interact with the system or application are not affected by CWE-184.

How Incomplete List of Disallowed Inputs Works

Root Cause

Incomplete List of Disallowed Inputs (CWE-184) occurs when a protection mechanism relies on a list of inputs that are not allowed by policy or otherwise require other action to neutralize, but the list is incomplete.

Attack Flow

1. An attacker finds an input that is not disallowed.
2. The attacker uses this input to bypass the intended protection mechanism.
3. The system or application is compromised.

Prerequisites to Exploit

• A list of disallowed inputs must be incomplete.
• An attacker must find an input that is not disallowed.

Vulnerable Code

def validate_input(input):
    if input in ['input1', 'input2']:
        return True
    else:
        return False

This code does not check for all possible malicious inputs, making it vulnerable to CWE-184.

Secure Code

def validate_input(input):
    allowed_inputs = ['input1', 'input2']
    if input in allowed_inputs:
        return True
    else:
        raise ValueError('Input is not allowed')

This code checks for all possible malicious inputs and raises an error if the input is not allowed.

Business Impact of Incomplete List of Disallowed Inputs

Confidentiality: CWE-184 can lead to unauthorized access to sensitive data, compromising confidentiality.

Integrity: CWE-184 can allow attackers to modify or delete sensitive data, compromising integrity.

Availability: CWE-184 can cause systems or applications to become unavailable, compromising availability.

Real-world business consequences of CWE-184 include:

• Financial losses due to data breaches
• Compliance issues due to regulatory non-compliance
• Reputation damage due to security incidents

Incomplete List of Disallowed Inputs Attack Scenario

1. An attacker finds an input that is not disallowed.
2. The attacker uses this input to bypass the intended protection mechanism.
3. The system or application is compromised.

How to Detect Incomplete List of Disallowed Inputs

Manual Testing

• Review code for incomplete lists of disallowed inputs
• Test system or application with malicious inputs

Automated Scanners (SAST / DAST)

Automated scanners can detect CWE-184 by identifying incomplete lists of disallowed inputs.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

False positives may occur when the pattern looks risky but is actually safe due to context a scanner can’t see. In such cases, review the code manually and consider additional testing.

How to Fix Incomplete List of Disallowed Inputs

• Use input validation and encoding mechanisms
• Ensure that your protection mechanism is complete

Framework-Specific Fixes for Incomplete List of Disallowed Inputs

Java

public boolean validateInput(String input) {
    String[] allowedInputs = {"input1", "input2"};
    return Arrays.asList(allowedInputs).contains(input);
}

Node.js

function validateInput(input) {
    const allowedInputs = ['input1', 'input2'];
    return allowedInputs.includes(input);
}

Python/Django

def validate_input(input):
    allowed_inputs = ['input1', 'input2']
    if input in allowed_inputs:
        return True
    else:
        raise ValueError('Input is not allowed')

PHP

function validateInput($input) {
    $allowedInputs = array('input1', 'input2');
    return in_array($input, $allowedInputs);
}

How to Ask AI to Check Your Code for Incomplete List of Disallowed Inputs

Review the following [language] code block for potential CWE-184 Incomplete List of Disallowed Inputs vulnerabilities and rewrite it using input validation and encoding mechanisms:

def validate_input(input):
    if input in ['input1', 'input2']:
        return True
    else:
        return False

Incomplete List of Disallowed Inputs Best Practices Checklist

✅ Always validate user input. ✅ Use encoding mechanisms to prevent attacks. ✅ Ensure that your protection mechanism is complete.

Incomplete List of Disallowed Inputs FAQ

How is CWE-184 related to other vulnerabilities?

CWE-693, CWE-1023, and CWE-79 are all related weaknesses that can lead to CWE-184.

What are the common consequences of CWE-184?

Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.

How can I prevent CWE-184?

Do not rely exclusively on detecting disallowed inputs. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity.

What are some framework-specific fixes for CWE-184?

This depends on the specific framework being used, but generally involves using input validation and encoding mechanisms.

How can I detect CWE-184 in my code?

Manual testing and automated scanners (SAST/DAST) can both be effective methods of detection.

What are some best practices for preventing CWE-184?

Always validate user input, use encoding mechanisms to prevent attacks, and ensure that your protection mechanism is complete.

How do I fix CWE-184 in my code?

Use input validation and encoding mechanisms, and ensure that your protection mechanism is complete.

Vulnerabilities Related to Incomplete List of Disallowed Inputs

References

• https://cwe.mitre.org/data/definitions/184.html
• https://capec.mitre.org/
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Incomplete List of Disallowed Inputs and other risks before an attacker does.