What is Use of Externally-Controlled Format (CWE-134)?

TL;DR: Use of Externally-Controlled Format String (CWE-134) is a high-severity vulnerability that occurs when a product uses a function that accepts a format string as an argument from an external source, leading to potential information disclosure and execution of arbitrary code.

What is Use of Externally-Controlled Format String?

Use of Externally-Controlled Format String (CWE-134) is a type of vulnerability that occurs when a product uses a function that accepts a format string as an argument from an external source. As defined by the MITRE Corporation under CWE-134, and classified by the OWASP Foundation under None., this vulnerability can lead to information disclosure and execution of arbitrary code.

Quick Summary

Use of Externally-Controlled Format String (CWE-134) is a high-severity vulnerability that occurs when a product uses a function that accepts a format string as an argument from an external source. This can lead to information disclosure, execution of arbitrary code, buffer overflows, denial of service, and incorrect data representation.

Jump to: Quick Summary · Use of Externally-Controlled Format String Overview · How Use of Externally-Controlled Format String Works · Business Impact of Use of Externally-Controlled Format String · Use of Externally-Controlled Format String Attack Scenario · How to Detect Use of Externally-Controlled Format String · How to Fix Use of Externally-Controlled Format String · Framework-Specific Fixes for Use of Externally-Controlled Format String · How to Ask AI to Check Your Code for Use of Externally-Controlled Format String · Use of Externally-Controlled Format String Best Practices Checklist · Use of Externally-Controlled Format String FAQ · Vulnerabilities Related to Use of Externally-Controlled Format String · References · Scan Your Own Site

Use of Externally-Controlled Format String Overview

What

Use of Externally-Controlled Format String (CWE-134) is a type of vulnerability that occurs when a product uses a function that accepts a format string as an argument from an external source.

Why it matters

This vulnerability can lead to information disclosure and execution of arbitrary code, which can have serious consequences for businesses, including financial losses, compliance issues, and reputational damage.

Where it occurs

Use of Externally-Controlled Format String (CWE-134) can occur in any product that uses format string functions, including C, C++, Java, Node.js, Python/Django, and PHP.

Who is affected

Any business or organization that uses products with format string functions can be affected by Use of Externally-Controlled Format String (CWE-134).

Who is NOT affected

Products that do not use format string functions are not affected by Use of Externally-Controlled Format String (CWE-134).

How Use of Externally-Controlled Format String Works

Root Cause

The root cause of Use of Externally-Controlled Format String (CWE-134) is the use of format string functions that accept arguments from external sources.

Attack Flow

1. An attacker provides a format string as an argument to a format string function.
2. The format string function processes the format string and performs operations on it.
3. The processed format string is used to access or modify sensitive data.

Prerequisites to Exploit

• The product must use format string functions that accept arguments from external sources.
• The attacker must be able to provide a format string as an argument to the format string function.

Vulnerable Code

#include <stdio.h>

void vulnerable_function(char *format_string) {
  printf(format_string);
}

int main() {
  char format_string[] = "%s";
  vulnerable_function(format_string);
  return 0;
}

This code is vulnerable to Use of Externally-Controlled Format String (CWE-134) because it uses the printf() function, which accepts a format string as an argument from an external source.

Secure Code

#include <stdio.h>

void secure_function(char *format_string) {
  printf("%s", format_string);
}

int main() {
  char format_string[] = "Hello, World!";
  secure_function(format_string);
  return 0;
}

This code is secure because it uses the printf() function with a static string as an argument, rather than accepting a format string from an external source.

Business Impact of Use of Externally-Controlled Format String

Confidentiality

Use of Externally-Controlled Format String (CWE-134) can lead to information disclosure, including sensitive data such as passwords and credit card numbers.

Integrity

Use of Externally-Controlled Format String (CWE-134) can lead to modification of sensitive data, which can compromise the integrity of the system.

Availability

Use of Externally-Controlled Format String (CWE-134) can lead to denial of service, making it difficult or impossible for users to access the system.

Use of Externally-Controlled Format String Attack Scenario

1. An attacker provides a format string as an argument to a format string function.
2. The format string function processes the format string and performs operations on it.
3. The processed format string is used to access or modify sensitive data.

How to Detect Use of Externally-Controlled Format String

Manual Testing

1. Review your code for format string functions.
2. Ensure that all format string functions are passed static strings which cannot be controlled by the user.
3. Verify that the proper number of arguments are always sent to each format string function.

Automated Scanners (SAST / DAST)

Automated scanners can detect Use of Externally-Controlled Format String (CWE-134) by analyzing code for format string functions and verifying that they are passed static strings.

PenScan Detection

PenScan’s automated scanners actively test for this issue.

False Positive Guidance

When reviewing findings, ensure that the format string function is indeed accepting an argument from an external source. If the argument is a static string or a hardcoded value, it may not be a vulnerability.

How to Fix Use of Externally-Controlled Format String

• Ensure that all format string functions are passed static strings which cannot be controlled by the user.
• Verify that the proper number of arguments are always sent to each format string function.
• Implement framework-specific fixes for your language or platform.

Framework-Specific Fixes for Use of Externally-Controlled Format String

Java

Use the String.format() method instead of concatenating strings.

public class SecureFunction {
  public static void main(String[] args) {
    String format_string = "Hello, World!";
    System.out.println(String.format(format_string));
  }
}

Node.js

Use template literals or a library like Lodash’s template function.

const secureFunction = (format_string) => {
  console.log(`${format_string}`);
};

secureFunction("Hello, World!");

Python/Django

Use f-strings or the format() method.

def secure_function(format_string):
  print(f"{format_string}")

secure_function("Hello, World!")

How to Ask AI to Check Your Code for Use of Externally-Controlled Format String

You can ask AI to review your code using a prompt like “Review the following C++ code block for potential CWE-134 Use of Externally-Controlled Format String vulnerabilities and rewrite it using the String.format() method.”

<div class="callout callout--violet">
  <div class="callout-label">Copy-paste prompt</div>
  <p>Review the following C++ code block for potential CWE-134 Use of Externally-Controlled Format String vulnerabilities and rewrite it using the `String.format()` method:</p>
  ```cpp
#include <iostream>

void secure_function(char *format_string) {
  std::cout << format_string;
}

int main() {
  char format_string[] = "Hello, World!";
  secure_function(format_string);
  return 0;
}

</div>

Use of Externally-Controlled Format String Best Practices Checklist

✅ Ensure that all format string functions are passed static strings which cannot be controlled by the user. ✅ Verify that the proper number of arguments are always sent to each format string function. ✅ Implement framework-specific fixes for your language or platform.

Use of Externally-Controlled Format String FAQ

How does Use of Externally-Controlled Format String occur?

Use of Externally-Controlled Format String (CWE-134) occurs when a product uses a function that accepts a format string as an argument, but the format string originates from an external source.

What are the common consequences of Use of Externally-Controlled Format String?

The common consequences of Use of Externally-Controlled Format String include information disclosure, execution of arbitrary code, buffer overflows, denial of service, and incorrect data representation.

How can I prevent Use of Externally-Controlled Format String in my application?

To prevent Use of Externally-Controlled Format String, ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well.

What are some framework-specific fixes for Use of Externally-Controlled Format String?

For Java, use the String.format() method instead of concatenating strings. For Node.js, use template literals or a library like Lodash’s template function. For Python/Django, use f-strings or the format() method.

How can I detect Use of Externally-Controlled Format String in my application?

You can detect Use of Externally-Controlled Format String using manual testing by reviewing your code for format string functions and ensuring that they are passed static strings. Automated scanners like PenScan’s can also detect this issue.

What is the business impact of Use of Externally-Controlled Format String?

The business impact of Use of Externally-Controlled Format String includes financial losses, compliance issues, and reputational damage due to data breaches and system compromise.

How can I ask AI to check my code for Use of Externally-Controlled Format String?

You can ask AI to review your code using a prompt like “Review the following C++ code block for potential CWE-134 Use of Externally-Controlled Format String vulnerabilities and rewrite it using the String.format() method.”

What are some best practices for preventing Use of Externally-Controlled Format String?

Some best practices include ensuring that all format string functions are passed static strings, using robust remediation techniques like canonicalization, and implementing framework-specific fixes.

Vulnerabilities Related to Use of Externally-Controlled Format String

References

• MITRE CWE-134
• CAPEC-135, CAPEC-67
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Externally-Controlled Format String and other risks before an attacker does.