Fallos del tipo CWE-625

19 resultados

Expressão regular excessivamente permissiva

Uma regex mal definida que aceita entradas muito mais amplas do que o esperado, validando dados que deveriam ser rejeitados. Isso acontece quando se usa padrões soltos demais (como `.*` sem âncoras), permitindo bypass de validações de segurança e aceitando dados malformados ou maliciosos.

Ejemplo

Um formulário que valida e-mail com a regex `.*@.*` aceita qualquer string com um `@` no meio, incluindo `admin@x` ou strings com caracteres especiais perigosos. O sistema então processa esses dados inválidos como válidos, causando injeção SQL ou XSS.

Cómo mitigar

Use regexes precisas com âncoras (`^` e `$`), classes de caracteres específicas e quantificadores definidos (ex: `[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$` para e-mail). Sempre teste a regex contra casos de borda e entradas malformadas; prefira validação em etapas (tipo, comprimento, formato) em vez de uma única regex complexa.

CVE-2018-8926HIGHPermissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remEPSS 1.7%CVE-2023-6544MEDIUMKeycloak: authorization bypassEPSS 1.1%CVE-2026-23651MEDIUMMicrosoft ACI Confidential Containers Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2020-8910MEDIUMAuth Bypass in Google's Closure-LibraryEPSS 0.5%CVE-2026-32973HIGHOpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path NormalizationEPSS 0.4%CVE-2026-40110HIGHjupyter-server CORS origin validation bypass via unanchored regex in allow_origin_patEPSS 0.3%CVE-2026-83617HIGHxmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatorEPSS 0.3%CVE-2026-83618HIGHxmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminatorEPSS 0.3%CVE-2026-83609HIGHxmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathEPSS 0.3%CVE-2026-82726MEDIUMAshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantEPSS 0.3%CVE-2026-55536CRITICALBrowser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)EPSS 0.3%CVE-2026-34763MEDIUMRack: Rack::Directory info disclosure and DoS via unescaped regex interpolationEPSS 0.2%CVE-2026-34830MEDIUMRack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginxEPSS 0.2%CVE-2026-64940HIGHTegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may aEPSS 0.2%CVE-2026-73845MEDIUMCKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)EPSS 0.2%CVE-2026-44587MEDIUMCarrierWave has a denylisted_content_type bypass via Unescaped Regex MetacharactersEPSS 0.2%CVE-2026-19278MEDIUMStackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappingsEPSS 0.2%CVE-2026-79965MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control EPSS 0.2%CVE-2026-37737MEDIUMsanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.maEPSS 0.2%