What is Struts: Form Field Without Validator (CWE-105)?

TL;DR: Struts: Form Field Without Validator (CWE-105) is a type of vulnerability that occurs when a form field is not validated by a corresponding validation form, introducing other weaknesses related to insufficient input validation.

What is Struts: Form Field Without Validator?

Struts: Form Field Without Validator (CWE-105) is a type of vulnerability that occurs when a form field is not validated by a corresponding validation form. As defined by the MITRE Corporation under CWE-105, and classified by the OWASP Foundation as Not directly mapped.

Quick Summary

Struts: Form Field Without Validator is a serious security issue that can lead to confidentiality, integrity, and availability risks. It occurs when a form field is not validated by a corresponding validation form, allowing attackers to bypass the validation checks and inject malicious code. This can have significant business impacts, including financial losses, compliance issues, and damage to reputation.

Jump to: Quick Summary · Struts: Form Field Without Validator Overview · How Struts: Form Field Without Validator Works · Business Impact of Struts: Form Field Without Validator · Struts: Form Field Without Validator Attack Scenario · How to Detect Struts: Form Field Without Validator · How to Fix Struts: Form Field Without Validator · Framework-Specific Fixes for Struts: Form Field Without Validator · How to Ask AI to Check Your Code for Struts: Form Field Without Validator · Struts: Form Field Without Validator Best Practices Checklist · Struts: Form Field Without Validator FAQ · Vulnerabilities Related to Struts: Form Field Without Validator · References · Scan Your Own Site

Struts: Form Field Without Validator Overview

What: Struts: Form Field Without Validator is a type of vulnerability that occurs when a form field is not validated by a corresponding validation form.

Why it matters: This can introduce other weaknesses related to insufficient input validation, leading to confidentiality, integrity, and availability risks.

Where it occurs: It typically occurs in web applications using Apache Struts, Java EE/EJB, or Spring.

Who is affected: Any user who interacts with the vulnerable application may be affected.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected.

How Struts: Form Field Without Validator Works

Root Cause

The root cause of this vulnerability is the lack of validation for form fields by a corresponding validation form.

Attack Flow

1. An attacker submits a malicious form with an invalid or missing field.
2. The application processes the form without validating it, allowing the attacker to inject malicious code.
3. The injected code executes, bypassing security checks and potentially leading to data breaches or system compromise.

Prerequisites to Exploit

• A malicious user must submit a form with an invalid or missing field.
• The application must not have adequate input validation in place.

Vulnerable Code

public class FormProcessor {
  public void processForm(Form form) {
    // No validation is performed on the form fields
    String fieldName = form.getFieldName();
    if (fieldName != null && !fieldName.isEmpty()) {
      // Process the field without validation
      System.out.println("Processing field: " + fieldName);
    }
  }
}

What makes this code vulnerable: The lack of validation for form fields allows an attacker to inject malicious code.

Secure Code

public class FormProcessor {
  public void processForm(Form form) {
    // Validate the form fields using a corresponding validation form
    String fieldName = form.getFieldName();
    if (fieldName != null && !fieldName.isEmpty()) {
      // Validate the field before processing it
      if (isValidField(fieldName)) {
        System.out.println("Processing field: " + fieldName);
      } else {
        System.out.println("Invalid field: " + fieldName);
      }
    }
  }

  private boolean isValidField(String fieldName) {
    // Implement input validation using a corresponding validation form
    return true; // Replace with actual implementation
  }
}

What makes this code secure: The presence of validation for form fields prevents an attacker from injecting malicious code.

Business Impact of Struts: Form Field Without Validator

The business impact includes confidentiality, integrity, and availability risks. If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.

• Confidentiality risk: Sensitive data may be exposed.
• Integrity risk: Data may be modified or deleted.
• Availability risk: Systems may become unavailable due to attacks.

Struts: Form Field Without Validator Attack Scenario

1. An attacker identifies a vulnerable application with unvalidated form fields.
2. The attacker submits a malicious form with an invalid or missing field.
3. The application processes the form without validating it, allowing the attacker to inject malicious code.
4. The injected code executes, bypassing security checks and potentially leading to data breaches or system compromise.

How to Detect Struts: Form Field Without Validator

Manual Testing

• Review the application’s forms and validate all form fields.
• Ensure that unused fields are constrained to be empty or undefined.
• Use a corresponding validation form to validate the form fields.

Automated Scanners (SAST / DAST)

• Static analysis tools can identify vulnerabilities in the code, including unvalidated form fields.
• Dynamic testing tools can simulate attacks and detect vulnerabilities in real-time.

PenScan Detection

PenScan’s scanner engines actively test for this issue. Scan your own website using PenScan to find Struts: Form Field Without Validator and other risks before an attacker does.

False Positive Guidance

When reviewing the results of automated scanners, consider the following:

• A false positive may occur if a pattern looks risky but is actually safe due to context.
• A real finding may be missed if the scanner cannot see the entire application flow.

How to Fix Struts: Form Field Without Validator

• Implement input validation using a corresponding validation form.
• Ensure that unused fields are constrained to be empty or undefined.
• Define a matching <field> validation rule in the Struts validation.xml for every form field, so every field is actually covered by the Validator framework instead of silently bypassing it.

Framework-Specific Fixes for Struts: Form Field Without Validator

Java (Apache Struts)

public class FormProcessor {
  public void processForm(Form form) {
    // Validate the form fields using a corresponding validation form
    String fieldName = form.getFieldName();
    if (fieldName != null && !fieldName.isEmpty()) {
      // Validate the field before processing it
      if (isValidField(fieldName)) {
        System.out.println("Processing field: " + fieldName);
      } else {
        System.out.println("Invalid field: " + fieldName);
      }
    }
  }

  private boolean isValidField(String fieldName) {
    // Implement input validation using a corresponding validation form
    return true; // Replace with actual implementation
  }
}

Node.js (Express)

const express = require('express');
const app = express();

app.post('/form', (req, res) => {
  const fieldName = req.body.fieldName;
  if (fieldName != null && !fieldName.isEmpty()) {
    // Validate the field before processing it
    if (isValidField(fieldName)) {
      console.log("Processing field: " + fieldName);
    } else {
      console.log("Invalid field: " + fieldName);
    }
  }
});

function isValidField(fieldName) {
  // Implement input validation using a corresponding validation form
  return true; // Replace with actual implementation
}

Python (Django)

from django.http import HttpResponse

def process_form(request):
  # Validate the form fields using a corresponding validation form
  fieldName = request.POST.get('fieldName')
  if fieldName != None and not fieldName.strip() == '':
    # Validate the field before processing it
    if isValidField(fieldName):
      print("Processing field: " + fieldName)
    else:
      print("Invalid field: " + fieldName)
  return HttpResponse("Form processed successfully")

PHP

public function process_form(Request $request) {
  // Validate the form fields using a corresponding validation form
  $fieldName = $request->input('fieldName');
  if ($fieldName != null && !empty($fieldName)) {
    // Validate the field before processing it
    if (isValidField($fieldName)) {
      echo "Processing field: " . $fieldName;
    } else {
      echo "Invalid field: " . $fieldName;
    }
  }
}

function isValidField($fieldName) {
  // Implement input validation using a corresponding validation form
  return true; // Replace with actual implementation
}

How to Ask AI to Check Your Code for Struts: Form Field Without Validator

You can ask AI to review your code block for potential CWE-105 Struts: Form Field Without Validator vulnerabilities and rewrite it using input validation techniques.

```python
from django.http import HttpResponse

def process_form(request):
  # Validate the form fields using a corresponding validation form
  fieldName = request.POST.get('fieldName')
  if fieldName != None and not fieldName.strip() == '':
    # Validate the field before processing it
    if isValidField(fieldName):
      print("Processing field: " + fieldName)
    else:
      print("Invalid field: " + fieldName)
  return HttpResponse("Form processed successfully")
```

Struts: Form Field Without Validator Best Practices Checklist

✅ Always validate form fields using a corresponding validation form. ✅ Ensure that unused fields are constrained to be empty or undefined. ✅ Define a matching <field> validation rule in the Struts validation.xml for every form field, so every field is actually covered by the Validator framework instead of silently bypassing it.

Struts: Form Field Without Validator FAQ

How does Struts: Form Field Without Validator occur?

It occurs when a form field is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.

What are the common consequences of Struts: Form Field Without Validator?

The common consequences include unexpected state and bypass protection mechanism. If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.

How do I detect Struts: Form Field Without Validator in my application?

You can detect it by manually testing your application’s forms and validating all form fields. If a field is unused, it is still important to constrain it so that it is empty or undefined.

What are the potential mitigations for Struts: Form Field Without Validator?

The potential mitigations include validating all form fields and constraining unused fields to be empty or undefined.

How do I prevent Struts: Form Field Without Validator in my application?

You can prevent it by implementing input validation and ensuring that all form fields are validated by a corresponding validation form.

What is the business impact of Struts: Form Field Without Validator?

The business impact includes confidentiality, integrity, and availability risks. If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.

Can you provide a real-world example of Struts: Form Field Without Validator?

Yes, a real-world example is when a web application has a form field that is not validated by a corresponding validation form, allowing attackers to bypass the validation checks and inject malicious code.

How do I ask AI to check my code for Struts: Form Field Without Validator?

You can ask AI to review your code block for potential CWE-105 Struts: Form Field Without Validator vulnerabilities and rewrite it using input validation techniques.

Vulnerabilities Related to Struts: Form Field Without Validator

References

• MITRE CWE-105
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Struts: Form Field Without Validator and other risks before an attacker does.