What is Incorrect Regular Expression (CWE-185)?

TL;DR: Incorrect Regular Expression (CWE-185) occurs when a product specifies a regular expression in a way that causes data to be improperly matched or compared, leading to unexpected states and varied impacts on confidentiality, integrity, and availability. Prevention involves refactoring regular expressions to ensure they match or compare data correctly and thoroughly testing them for potential weaknesses.

At-a-Glance

What is Incorrect Regular Expression?

Incorrect Regular Expression (CWE-185) is a type of vulnerability that occurs when a product specifies a regular expression in a way that causes data to be improperly matched or compared. As defined by the MITRE Corporation under CWE-185, and classified by the OWASP Foundation under No official mapping…

Quick Summary

Incorrect Regular Expression can lead to unexpected states and varied impacts on confidentiality, integrity, and availability. It is essential to prevent Incorrect Regular Expression through refactoring and thorough testing of regular expressions.

Jump to: What is Incorrect Regular Expression? · Quick Summary · Incorrect Regular Expression Overview · How Incorrect Regular Expression Works · Business Impact of Incorrect Regular Expression · Incorrect Regular Expression Attack Scenario · How to Detect Incorrect Regular Expression · How to Fix Incorrect Regular Expression · Framework-Specific Fixes for Incorrect Regular Expression · How to Ask AI to Check Your Code for Incorrect Regular Expression · Incorrect Regular Expression Best Practices Checklist · Incorrect Regular Expression FAQ · Vulnerabilities Related to Incorrect Regular Expression · References · Scan Your Own Site

Incorrect Regular Expression Overview

What: Incorrect Regular Expression (CWE-185) is a type of vulnerability that occurs when a product specifies a regular expression in a way that causes data to be improperly matched or compared.

Why it matters: This can lead to unexpected states and varied impacts on confidentiality, integrity, and availability.

Where it occurs: Incorrect Regular Expression can occur in any product that uses regular expressions for matching or comparing data.

Who is affected: Any user of the product that uses regular expressions may be affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input, systems already using refactoring and thorough testing of regular expressions as a mitigation…

How Incorrect Regular Expression Works

Root Cause

The root cause of Incorrect Regular Expression is the improper specification of a regular expression, leading to incorrect matching or comparison of data.

Attack Flow

1. The attacker specifies an invalid regular expression in the product.
2. The product uses the specified regular expression for matching or comparing data.
3. The product incorrectly matches or compares data due to the invalid regular expression.

Prerequisites to Exploit

• The product must use regular expressions for matching or comparing data.
• The attacker must be able to specify an invalid regular expression in the product.

Vulnerable Code

import re

def validate_input(input):
    pattern = r"^[a-zA-Z]+$"
    if not re.match(pattern, input):
        return False
    else:
        return True

This code is vulnerable because it uses a regular expression that does not correctly match all possible inputs.

Secure Code

import re

def validate_input(input):
    pattern = r"^[a-zA-Z]+$"
    if not re.match(pattern, input):
        raise ValueError("Invalid input")
    else:
        return True

This code is secure because it uses a regular expression that correctly matches all possible inputs and raises an error if the input is invalid.

Business Impact of Incorrect Regular Expression

Confidentiality: Incorrect Regular Expression can lead to unexpected states and varied impacts on confidentiality, including unauthorized access to sensitive data.

• Integrity: Incorrect Regular Expression can also impact integrity by allowing attackers to modify or delete data.
• Availability: Finally, Incorrect Regular Expression can disrupt availability by causing the product to become unresponsive or crash.

Business Consequences:

• Financial losses due to data breaches or system downtime
• Compliance issues due to regulatory requirements for data protection and security
• Reputation damage due to public disclosure of vulnerabilities

Incorrect Regular Expression Attack Scenario

1. The attacker specifies an invalid regular expression in the product.
2. The product uses the specified regular expression for matching or comparing data.
3. The product incorrectly matches or compares data due to the invalid regular expression.

How to Detect Incorrect Regular Expression

Manual Testing

• Review code for regular expressions
• Test regular expressions with a variety of inputs
• Verify that regular expressions correctly match or compare data

Automated Scanners (SAST / DAST)

• Static analysis can detect issues in the code, but may not catch all cases.
• Dynamic testing is necessary to ensure that the product behaves correctly under various scenarios.

PenScan Detection

PenScan’s scanner engines actively test for this issue and provide detailed reports on any findings.

False Positive Guidance

• Be cautious of regular expressions that appear to be invalid but are actually correct due to context or other factors.
• Verify all findings with manual testing before taking corrective action.

How to Fix Incorrect Regular Expression

• Refactor the regular expression to ensure it correctly matches or compares data
• Thoroughly test the regular expression for potential weaknesses
• Use AI-assisted tools to analyze code and suggest improvements

Framework-Specific Fixes for Incorrect Regular Expression

Java

import java.util.regex.Pattern;

public class RegexValidator {
    public static boolean validateInput(String input) {
        Pattern pattern = Pattern.compile("^[a-zA-Z]+$");
        if (!pattern.matcher(input).matches()) {
            return false;
        } else {
            return true;
        }
    }
}

Node.js

const regex = /^[a-zA-Z]+$/;

function validateInput(input) {
  if (regex.test(input)) {
    return true;
  } else {
    return false;
  }
}

Python/Django

import re

def validate_input(input):
    pattern = r"^[a-zA-Z]+$"
    if not re.match(pattern, input):
        raise ValueError("Invalid input")
    else:
        return True

PHP

function validateInput($input) {
  $pattern = "/^[a-zA-Z]+$/";
  if (preg_match($pattern, $input)) {
    return true;
  } else {
    return false;
  }
}

How to Ask AI to Check Your Code for Incorrect Regular Expression

Review the following [language] code block for potential CWE-185 Incorrect Regular Expression vulnerabilities and rewrite it using refactoring and thorough testing of regular expressions:

import re

def validate_input(input):
    pattern = r"^[a-zA-Z]+$"
    if not re.match(pattern, input):
        return False
    else:
        return True

Incorrect Regular Expression Best Practices Checklist

✅ Refactor regular expressions to ensure they correctly match or compare data. ✅ Thoroughly test regular expressions for potential weaknesses. ✅ Use AI-assisted tools to analyze code and suggest improvements.

Incorrect Regular Expression FAQ

How does Incorrect Regular Expression occur?

Incorrect Regular Expression occurs when a product specifies a regular expression in a way that causes data to be improperly matched or compared.

What is the root cause of Incorrect Regular Expression?

The root cause of Incorrect Regular Expression is the improper specification of a regular expression, leading to incorrect matching or comparison of data.

How does Incorrect Regular Expression impact business?

Incorrect Regular Expression can lead to unexpected states and varied impacts on confidentiality, integrity, and availability.

What are some common consequences of Incorrect Regular Expression?

Common consequences include unexpected states, bypass protection mechanisms, and varied impacts on confidentiality, integrity, and availability.

How do I prevent Incorrect Regular Expression?

Prevention involves refactoring regular expressions to ensure they match or compare data correctly and thoroughly testing them for potential weaknesses.

Can AI assist in detecting and preventing Incorrect Regular Expression?

Yes, AI can help detect and prevent Incorrect Regular Expression by analyzing code and suggesting improvements.

What are some best practices for preventing Incorrect Regular Expression?

Best practices include refactoring regular expressions to ensure they match or compare data correctly, thoroughly testing them for potential weaknesses, and using AI-assisted tools to analyze code.

Vulnerabilities Related to Incorrect Regular Expression

References

• MITRE CWE-185
• CAPEC 15,6,79
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Incorrect Regular Expression and other risks before an attacker does.