CWE-625: Permissive Regular Expression

Extended Description

This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include: not identifying the beginning and end of the target string using wildcards instead of acceptable character ranges others

Code Examples & CVEs

Demonstrative Examples

The following code takes phone numbers as input, and uses a regular expression to reject invalid phone numbers.

An attacker could provide an argument such as: "; ls -l ; echo 123-456" This would pass the check, since "123-456" is sufficient to match the "\d+-\d+" portion of the regular expression.

BadPerl

$phone = GetPhoneNumber();if ($phone =~ /\d+-\d+/) {                            # looks like it only has hyphens and digits                            system("lookup-phone $phone");}                      else {error("malformed number!");}

This code uses a regular expression to validate an IP string prior to using it in a call to the "ping" command.

Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^ or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a matched regex pattern. Since the ping command supports octal and hex prepended IP addresses, it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that the attacker cannot reach directly.

BadPython

import subprocess 		  import re 		   		  def validate_ip_regex(ip: str): 		   		    ip_validator = re.compile(r"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}") 		    if ip_validator.match(ip): 		     		      return ip 		     		    else: 		     		      raise ValueError("IP address does not match valid pattern.") 		     		   		   		  def run_ping_regex(ip: str): 		   		    validated = validate_ip_regex(ip) 		    # The ping command treats zero-prepended IP addresses as octal 		    result = subprocess.call(["ping", validated]) 		    print(result)

Observed CVE Examples (8)

CVE-2021-22204

Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.

View Details

CVE-2006-1895

".*" regexp leads to static code injection

View Details

CVE-2002-2175

insertion of username into regexp results in partial comparison, causing wrong database entry to be updated when one username is a substring of another.

View Details

CVE-2006-4527

regexp intended to verify that all characters are legal, only checks that at least one is legal, enabling file inclusion.

View Details

CVE-2005-1949

Regexp for IP address isn't anchored at the end, allowing appending of shell metacharacters.

View Details

CVE-2002-2109

Regexp isn't "anchored" to the beginning or end, which allows spoofed values that have trusted values as substrings.

View Details

CVE-2006-6511

regexp in .htaccess file allows access of files whose names contain certain substrings

View Details

CVE-2006-6629

allow load of macro files whose names contain certain substrings.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-625 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-625, Permissive Regular Expression, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Permissive Regular Expression during Implementation

MITRE associates mitigation with Implementation; documented detection approaches include Automated Static Analysis; recorded impacts include Bypass Protection Mechanism. Use these source-defined anchors to turn CWE-625 into implementation, review, and verification checks for the affected component.

CWE-625: Permissive Regular Expression — MITRE CWE

Triage CWE-625 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-625, Permissive Regular Expression, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-625

Apply MITRE's full root-cause mapping guidance when using CWE-625, Permissive Regular Expression. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-625 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-625, Permissive Regular Expression. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-625: Permissive Regular Expression?+

CWE-625: Permissive Regular Expression is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a regular expression that does not sufficiently restrict the set of allowed values. This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include: not identifying the beginning and end of the target string using wildcards instead of acceptable character ranges others

What are the security consequences of Permissive Regular Expression?+

If exploited, CWE-625 (Permissive Regular Expression) it can compromise Access Control, leading to outcomes such as Bypass Protection Mechanism.

How do you prevent or mitigate Permissive Regular Expression?+

Recommended mitigations for CWE-625 include: When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.

Which programming languages are affected by Permissive Regular Expression?+

CWE-625 commonly affects Perl and PHP. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Permissive Regular Expression?+

MITRE documents real CVEs mapped to CWE-625, including CVE-2021-22204, CVE-2006-1895, CVE-2002-2175, CVE-2006-4527 and CVE-2005-1949. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-625 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-625: Permissive Regular Expression

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (8)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-625 with SSDF evidence

Address Permissive Regular Expression during Implementation

Triage CWE-625 against known exploitation evidence

Apply precise root-cause mapping to CWE-625

Validate CWE-625 with root-cause mapping checks

Frequently Asked Questions

Learn More