Umbra Wiki weakness weakness/CWE-624
Back to wiki

CWE-624 — Executable Regular Expression Error

provenance: imported · CWE: CWE-624

CWE-624: Executable Regular Expression Error

MITRE CWE weakness

Kind Weakness
Abstraction Base
Status Incomplete
Likelihood of exploit

Description

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Case (2) is possible in the PHP preg_replace() function, and possibly in other languages when a user-controlled input is inserted into a string that is later parsed as a regular expression.

Common consequences

  • Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands

Mitigations

Implementation — The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as \Q and \E in Perl.

References

  • CWE page: https://cwe.mitre.org/data/definitions/624.html
  • CWE list: https://cwe.mitre.org/data/index.html