What is Struts: Validator Without Form Field (CWE-110)?

AI-friendly summary

TL;DR: Struts: Validator Without Form Field (CWE-110) is a vulnerability that occurs when outdated validation logic is not updated, leading to unchecked input being the root cause of security problems. To fix it, keep your validation logic up-to-date and ensure all fields are properly associated with forms.

At-a-Glance

What is Struts: Validator Without Form Field?

Struts: Validator Without Form Field (CWE-110) is a type of vulnerability that occurs when validation fields do not appear in forms they are associated with, indicating outdated validation logic. As defined by the MITRE Corporation under CWE-110.

Quick Summary

Struts: Validator Without Form Field is a vulnerability that can lead to security problems such as cross-site scripting, SQL injection, and process control vulnerabilities. It occurs when validation fields do not appear in forms they are associated with, indicating outdated validation logic. To fix this issue, maintain and keep your validation logic up-to-date, ensuring that all fields are properly associated with forms.

Jump to: At-a-Glance · What is Struts: Validator Without Form Field? · Quick Summary · Struts: Validator Without Form Field Overview · How Struts: Validator Without Form Field Works · Business Impact of Struts: Validator Without Form Field · Struts: Validator Without Form Field Attack Scenario · How to Detect Struts: Validator Without Form Field · How to Fix Struts: Validator Without Form Field · Framework-Specific Fixes for Struts: Validator Without Form Field · How to Ask AI to Check Your Code for Struts: Validator Without Form Field · Struts: Validator Without Form Field Best Practices Checklist · Struts: Validator Without Form Field FAQ · Vulnerabilities Related to Struts: Validator Without Form Field · References

Struts: Validator Without Form Field Overview

What: Struts: Validator Without Form Field (CWE-110) is a type of vulnerability that occurs when validation fields do not appear in forms they are associated with, indicating outdated validation logic.

Why it matters: The consequences of Struts: Validator Without Form Field include unchecked input being the root cause of some of today’s worst and most common software security problems, such as cross-site scripting, SQL injection, and process control vulnerabilities.

Where it occurs: This vulnerability can occur in any application that uses Struts for validation logic.

Who is affected: Any user who interacts with an application that has outdated or missing validation fields may be affected by this vulnerability.

Who is NOT affected: Users who do not interact with applications that use Struts for validation logic are not affected by this vulnerability.

How Struts: Validator Without Form Field Works

Root Cause

The root cause of Struts: Validator Without Form Field (CWE-110) is outdated or missing validation fields in forms.

Attack Flow

1. An attacker sends a request to the application with malicious input.
2. The application’s validation logic does not check for the presence of validation fields in the form.
3. The application processes the malicious input, leading to security problems such as cross-site scripting, SQL injection, and process control vulnerabilities.

Prerequisites to Exploit

The following prerequisites must be true for this vulnerability to be exploitable:

• Outdated or missing validation fields in forms
• Malicious input sent by an attacker

Vulnerable Code

// Vulnerable code
public class UserValidator {
  public boolean validate(User user) {
    // Validation logic that does not appear in the form
    if (user.getName().length() > 10) {
      return false;
    }
    return true;
  }
}

The above code demonstrates a vulnerable validation logic that does not check for the presence of validation fields in the form.

Secure Code

// Secure code
public class UserValidator {
  public boolean validate(User user) {
    // Validation logic that checks for the presence of validation fields in the form
    if (user.getName().length() > 10 && isValidationFieldPresent(user)) {
      return false;
    }
    return true;
  }

  private boolean isValidationFieldPresent(User user) {
    // Check if validation field is present in the form
    return user.getForm().contains("validation_field");
  }
}

The above code demonstrates a secure validation logic that checks for the presence of validation fields in the form.

Business Impact of Struts: Validator Without Form Field

Confidentiality: The confidentiality impact of this vulnerability is not significant, as it does not directly affect sensitive data.

Integrity: The integrity impact of this vulnerability is moderate, as it can lead to security problems such as SQL injection and process control vulnerabilities.

Availability: The availability impact of this vulnerability is low, as it does not directly affect the application’s availability.

Real-world business consequences of this vulnerability include:

• Financial losses due to security breaches
• Compliance issues due to regulatory requirements
• Reputation damage due to public disclosure of security problems

Struts: Validator Without Form Field Attack Scenario

1. An attacker sends a request to the application with malicious input.
2. The application’s validation logic does not check for the presence of validation fields in the form.
3. The application processes the malicious input, leading to security problems such as cross-site scripting, SQL injection, and process control vulnerabilities.

How to Detect Struts: Validator Without Form Field

Manual Testing

To detect this vulnerability manually, review your application’s validation logic and check for any outdated or missing fields in forms.

• Review the application’s codebase for any outdated or missing validation fields.
• Check if the application uses Struts for validation logic.
• Verify that all fields are properly associated with forms.

Automated Scanners (SAST / DAST)

Automated scanners can detect this vulnerability by checking for outdated or missing validation fields in forms.

• Static analysis tools can identify potential issues with validation logic.
• Dynamic analysis tools can simulate user input and check for security problems such as SQL injection and process control vulnerabilities.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

To avoid false positives, ensure that all fields are properly associated with forms and that the application uses up-to-date validation logic.

How to Fix Struts: Validator Without Form Field

• Maintain and keep your validation logic up-to-date.
• Ensure that all fields are properly associated with forms.
• Use automated scanners to identify potential issues.

Framework-Specific Fixes for Struts: Validator Without Form Field

Java

// Secure code in Java
public class UserValidator {
  public boolean validate(User user) {
    // Validation logic that checks for the presence of validation fields in the form
    if (user.getName().length() > 10 && isValidationFieldPresent(user)) {
      return false;
    }
    return true;
  }

  private boolean isValidationFieldPresent(User user) {
    // Check if validation field is present in the form
    return user.getForm().contains("validation_field");
  }
}

Node.js

// Secure code in Node.js
function validateUser(user) {
  // Validation logic that checks for the presence of validation fields in the form
  if (user.getName().length > 10 && isValidationFieldPresent(user)) {
    return false;
  }
  return true;
}

function isValidationFieldPresent(user) {
  // Check if validation field is present in the form
  return user.form.includes("validation_field");
}

Python/Django

# Secure code in Python/Django
class UserValidator:
  def validate(self, user):
    # Validation logic that checks for the presence of validation fields in the form
    if user.name.length > 10 and is_validation_field_present(user):
      return False
    return True

def is_validation_field_present(user):
  # Check if validation field is present in the form
  return "validation_field" in user.form

PHP

// Secure code in PHP
function validateUser($user) {
  // Validation logic that checks for the presence of validation fields in the form
  if (strlen($user->getName()) > 10 && isValidationFieldPresent($user)) {
    return false;
  }
  return true;
}

function isValidationFieldPresent($user) {
  // Check if validation field is present in the form
  return strpos($user->form, "validation_field") !== false;
}

How to Ask AI to Check Your Code for Struts: Validator Without Form Field

You can use AI coding assistants by providing them with a copy-pasteable prompt, such as “Review the following Java code block for potential CWE-110 Struts: Validator Without Form Field vulnerabilities and rewrite it so every validator has a matching form field declared.”

Struts: Validator Without Form Field Best Practices Checklist

✅ Review your application’s validation logic regularly to ensure that all fields are properly associated with forms. ✅ Use automated scanners to identify potential issues with validation logic. ✅ Maintain and keep your validation logic up-to-date.

Struts: Validator Without Form Field FAQ

How does Struts: Validator Without Form Field occur?

Struts: Validator Without Form Field (CWE-110) occurs when validation fields do not appear in forms they are associated with, indicating that the validation logic is out of date.

What are the consequences of Struts: Validator Without Form Field?

The consequences of Struts: Validator Without Form Field include unchecked input being the root cause of some of today’s worst and most common software security problems, such as cross-site scripting, SQL injection, and process control vulnerabilities.

How can I detect Struts: Validator Without Form Field in my code?

To detect Struts: Validator Without Form Field, you should use manual testing by reviewing your application’s validation logic and checking for any outdated or missing fields. You can also use automated scanners to identify potential issues.

What is the best way to fix Struts: Validator Without Form Field in my code?

The best way to fix Struts: Validator Without Form Field is to maintain and keep your validation logic up-to-date, ensuring that all fields are properly associated with forms.

Can you provide an example of vulnerable code for Struts: Validator Without Form Field?

Yes, here is an example of vulnerable code for Struts: Validator Without Form Field:

How can I use AI to check my code for Struts: Validator Without Form Field?

You can use AI coding assistants by providing them with a copy-pasteable prompt, such as “Review the following Java code block for potential CWE-110 Struts: Validator Without Form Field vulnerabilities and rewrite it so every validator has a matching form field declared.”

What are some best practices to prevent Struts: Validator Without Form Field in my code?

Some best practices to prevent Struts: Validator Without Form Field include keeping your validation logic up-to-date, ensuring that all fields are properly associated with forms, and using automated scanners to identify potential issues.

What are some common mistakes to avoid when fixing Struts: Validator Without Form Field in my code?

Some common mistakes to avoid when fixing Struts: Validator Without Form Field include not updating outdated validation logic or not ensuring that all fields are properly associated with forms.

Vulnerabilities Related to Struts: Validator Without Form Field

References

• MITRE
• NVD

Scan Your Own Site

PenScan’s scanner engines actively test for this issue.